Suspicious PowerShell Parent Process
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects a suspicious or uncommon parent processes of PowerShell
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PARENTPROCESSNAME contains "tomcat" OR PARENTPROCESSNAME endswith "\amigo.exe,\browser.exe,\chrome.exe,\firefox.exe,\httpd.exe,\iexplore.exe,\jbosssvc.exe,\microsoftedge.exe,\microsoftedgecp.exe,\MicrosoftEdgeSH.exe,\mshta.exe,\nginx.exe,\outlook.exe,\php-cgi.exe,\regsvr32.exe,\rundll32.exe,\safari.exe,\services.exe,\sqlagent.exe,\sqlserver.exe,\sqlservr.exe,\vivaldi.exe,\w3wp.exe") AND (PROCESSNAME endswith "\powershell.exe,\pwsh.exe" OR COMMANDLINE contains "/c powershell,/c pwsh" OR MESSAGE = "Windows PowerShell" OR PRODUCT_NAME = "PowerShell Core 6" OR ORIGINALFILENAME = "PowerShell.EXE,pwsh.dll") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Teymur Kheirkhabarov, Harish Segar
