Non Interactive PowerShell Process Spawned

Severity: low
Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)
Source: upstream

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection`

or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
OriginalFileName: PowerShell.EXE
OriginalFileName: pwsh.dll

Stage 2: `not 1 of filter_main_*`

or:
ParentImage|endswith: ':\Windows\SysWOW64\explorer.exe'
ParentImage|endswith: ':\Windows\System32\CompatTelRunner.exe'
ParentImage|endswith: ':\Windows\explorer.exe'
ParentImage: ':\$WINDOWS.~BT\Sources\SetupHost.exe'

Stage 3: `not 1 of filter_optional_*`

or:
ParentCommandLine|contains: ' --ms-enable-electron-run-as-node '
ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
ParentImage|endswith: '\WindowsTerminal.exe'
ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal_'
ParentImage|endswith: ':\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140)
`OriginalFileName`	eq	`PowerShell.EXE` corpus 64 (sigma 60, splunk 4) `pwsh.dll` corpus 72 (sigma 68, splunk 4)
`ParentCommandLine`	match	`--ms-enable-electron-run-as-node`
`ParentImage`	ends_with	`:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe` `:\Windows\SysWOW64\explorer.exe` `:\Windows\System32\CompatTelRunner.exe` `:\Windows\explorer.exe` `\AppData\Local\Programs\Microsoft VS Code\Code.exe` corpus 2 (sigma 2) `\WindowsTerminal.exe` corpus 3 (sigma 3)
`ParentImage`	eq	`:\$WINDOWS.~BT\Sources\SetupHost.exe`
`ParentImage`	match	`:\Program Files\WindowsApps\Microsoft.WindowsTerminal_`