{"id":"64e8e417-c19a-475a-8d19-98ea705394cc","title":"Alternate PowerShell Hosts - PowerShell Module","description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2019-08-11","modified":"2025-10-17","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"falsepositives":["Programs using PowerShell directly without invocation of a dedicated interpreter","MSP Detection Searcher","Citrix ConfigSync.ps1"],"references":["https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html"],"source_path":"rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml","source_sha256":"8896c908f7ab5b6a9a80cf004e0ec8c6aa17843fc6b7148f3451a6ee6f5efd43","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Alternate PowerShell Hosts - PowerShell Module\nid: 64e8e417-c19a-475a-8d19-98ea705394cc\nstatus: test\ndescription: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe\nreferences:\n    - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html\nauthor: Roberto Rodriguez @Cyb3rWard0g\ndate: 2019-08-11\nmodified: 2025-10-17\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_module\n    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b\ndetection:\n    selection:\n        ContextInfo|contains: '*'\n    filter_powershell:\n        # This filter covers the following use cases\n        #   - When powershell is called directly from commandline via keyword powershell or powershell.exe\n        #   - Or called via path but not with full \"\".exe\". Example: C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell\n        ContextInfo|contains:\n            - '= powershell' # Host Application=...powershell.exe or Application hote=...powershell.exe in French Win10 event\n            - '= C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell'\n            - '= C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell'\n            # In some cases powershell was invoked with inverted slashes\n            - '= C:/Windows/System32/WindowsPowerShell/v1.0/powershell'\n            - '= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'\n            # In some cases \\??\\C:.. is used\n            - '= \\\\\\?\\?\\C:Windows\\System32\\WindowsPowerShell\\v1.0\\powershell'\n            - '= \\\\\\?\\?\\C:Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell'\n    filter_sdiagnhost:\n        ContextInfo|contains: '= C:\\WINDOWS\\System32\\sdiagnhost.exe -Embedding' # When MSDT is launched for example\n    filter_citrix:\n        ContextInfo|contains: 'ConfigSyncRun.exe'\n    filter_adace:  # Active Directory Administrative Center Enhancements\n        ContextInfo|contains: 'C:\\Windows\\system32\\dsac.exe'\n    filter_winrm:\n        ContextInfo|contains: 'C:\\Windows\\system32\\wsmprovhost.exe -Embedding'\n    filter_help_update:\n        Payload|contains:\n            - 'Update-Help'\n            - 'Failed to update Help for the module'\n    condition: selection and not 1 of filter_*\nfalsepositives:\n    - Programs using PowerShell directly without invocation of a dedicated interpreter\n    - MSP Detection Searcher\n    - Citrix ConfigSync.ps1\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/64e8e417-c19a-475a-8d19-98ea705394cc.json","kind":"sigma"}