Alternate PowerShell Hosts - PowerShell Module

Title: Alternate PowerShell Hosts - PowerShell Module
Status: test
Description:Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
References:
  -https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-11
modified:2025-10-17
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection:
    ContextInfo|contains: '*'
  filter_powershell:
    ContextInfo|contains:
      -'= powershell'
      -'= C:\Windows\System32\WindowsPowerShell\v1.0\powershell'
      -'= C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
      -'= C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
      -'= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
      -'= \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell'
      -'= \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'

  filter_sdiagnhost:
    ContextInfo|contains: '= C:\WINDOWS\System32\sdiagnhost.exe -Embedding'
  filter_citrix:
    ContextInfo|contains: 'ConfigSyncRun.exe'
  filter_adace:
    ContextInfo|contains: 'C:\Windows\system32\dsac.exe'
  filter_winrm:
    ContextInfo|contains: 'C:\Windows\system32\wsmprovhost.exe -Embedding'
  filter_help_update:
    Payload|contains:
      -'Update-Help'
      -'Failed to update Help for the module'

  condition:selection and not 1 of filter_*
Falsepositives:
  -Programs using PowerShell directly without invocation of a dedicated interpreter
  -MSP Detection Searcher
  -Citrix ConfigSync.ps1
Level: medium