Sunturai
Back to results
MediumSplunk security contentMauricio Velazco +2

Possible Lateral Movement PowerShell Spawn

The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. It leverages data…

Description

The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names, as well as command-line executions. This activity is significant as it could indicates lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this behavior could allow attackers to execute code remotely, escalate privileges, or persist within the environment.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the 6 ATT&CK techniques it maps to.

Log source category
sysmon_eventid_1

Known benign triggers

  • False positives are expected from legitimate use of WMI or certain services. Apply additoinal filters as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice