Detectionmediumtest

Execute Code with Pester.bat

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Julia Fomina, oscd.communityCreated Thu Oct 08Updated Thu Nov 0959e938ff-0d6d-4dc3-b13f-36cc28734d4ewindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    powershell_module:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Pester'
            - 'Get-Help'
    cmd_execution:
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'pester'
            - ';'
    get_help:
        CommandLine|contains:
            - 'help'
            - '\?'
    condition: powershell_module or (cmd_execution and get_help)