{"id":"754ed792-634f-40ae-b3bc-e0448d33f695","title":"Suspicious PowerShell Parent Process","description":"Detects a suspicious or uncommon parent processes of PowerShell","author":"Teymur Kheirkhabarov, Harish Segar","status":"test","level":"high","date":"2020-03-20","modified":"2023-02-04","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Other scripts"],"references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml","source_sha256":"65c6e32685197796a5b3225a331afd375bd022cb5d772699482aed96bca792b5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious PowerShell Parent Process\nid: 754ed792-634f-40ae-b3bc-e0448d33f695\nrelated:\n    - id: 692f0bec-83ba-4d04-af7e-e884a96059b6\n      type: derived\nstatus: test\ndescription: Detects a suspicious or uncommon parent processes of PowerShell\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26\nauthor: Teymur Kheirkhabarov, Harish Segar\ndate: 2020-03-20\nmodified: 2023-02-04\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        - ParentImage|contains: 'tomcat'\n        - ParentImage|endswith:\n              - '\\amigo.exe'\n              - '\\browser.exe'\n              - '\\chrome.exe'\n              - '\\firefox.exe'\n              - '\\httpd.exe'\n              - '\\iexplore.exe'\n              - '\\jbosssvc.exe'\n              - '\\microsoftedge.exe'\n              - '\\microsoftedgecp.exe'\n              - '\\MicrosoftEdgeSH.exe'\n              - '\\mshta.exe'\n              - '\\nginx.exe'\n              - '\\outlook.exe'\n              - '\\php-cgi.exe'\n              - '\\regsvr32.exe'\n              - '\\rundll32.exe'\n              - '\\safari.exe'\n              - '\\services.exe'\n              - '\\sqlagent.exe'\n              - '\\sqlserver.exe'\n              - '\\sqlservr.exe'\n              - '\\vivaldi.exe'\n              - '\\w3wp.exe'\n    selection_powershell:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - CommandLine|contains:\n              - '/c powershell'  # FPs with sub processes that contained \"powershell\" somewhere in the command line\n              - '/c pwsh'\n        - Description: 'Windows PowerShell'\n        - Product: 'PowerShell Core 6'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    condition: all of selection_*\nfalsepositives:\n    - Other scripts\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/754ed792-634f-40ae-b3bc-e0448d33f695.json","kind":"sigma"}