Detection of PowerShell Executing Batch Scripts

Adversaries frequently leverage the Windows command shell and PowerShell to execute batch scripts (typically with .bat or .cmd extensions) as part of their post-exploitation activities. This technique allows attackers to run lists of sequential commands, perform repetitive system tasks, or implement complex logic such as conditionals and loops under the context of an existing PowerShell session. Because batch files can be used to facilitate both legitimate administrative tasks and malicious activity, monitoring the invocation of these scripts via PowerShell is essential for identifying unauthorized execution patterns. Detection engineers should focus on PowerShell Script Block Logging (Event ID 4104) to capture the full command context when Start-Process is used to trigger these scripts.

Impact

Successful execution of malicious batch scripts can lead to full system compromise, lateral movement, or the execution of additional staged payloads. If undetected, attackers can maintain persistence or execute automated tasks across multiple systems within an enterprise network.

Recommendation

• Enable Windows PowerShell Script Block Logging (Event ID 4104) across all endpoints to ensure the full content of executed scripts is captured in logs.
• Deploy the provided Sigma rule to your SIEM to monitor for PowerShell scripts attempting to launch .bat or .cmd files.
• Establish a baseline for administrative scripts used in your environment to tune out false positives originating from legitimate system management activity.