Sigma rule: Alternate PowerShell Hosts - Image

Rule

Title

Alternate PowerShell Hosts - Image

Status

deprecated

Level

low

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2019/09/12

Modified

2023/06/01

File

deprecated/windows/image_load_alternate_powershell_hosts_moduleload.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Log source

product

windows

category

image_load

Detection

selection:
    Description: 'System.Management.Automation'
    ImageLoaded|contains: 'System.Management.Automation'
filter_generic:
    - Image|endswith:
        - '\powershell.exe'
        - '\mscorsvw.exe'
    - Image|startswith:
        - 'C:\Program Files (x86)\Microsoft Visual Studio\'
        - 'C:\Program Files\Microsoft Visual Studio\'
        - 'C:\Windows\System32\'
        - 'C:\Program Files\Citrix\ConfigSync\'
    - Image: 'C:\Program Files\PowerShell\7\pwsh.exe'
filter_aurora:
    # This filter is to avoid a race condition FP with this specific ETW provider in aurora
    Image: null
condition: selection and not 1 of filter_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/image_load_alternate_powershell_hosts_moduleload.yml