Suspicious PowerShell Start-Process PassThru Usage

This detection brief addresses the use of the PowerShell 'Start-Process' cmdlet (or its alias 'saps') combined with the '-PassThru' and '-FilePath' parameters. Attackers leverage this combination to launch malicious processes in the background, allowing them to remain detached from the parent shell while maintaining the ability to capture process objects. This technique is frequently observed in post-exploitation scenarios where adversaries attempt to maintain persistence or execute lateral movement tools stealthily. While this cmdlet is a standard management tool, its usage in scripts to trigger background operations without interactive user oversight warrants monitoring, especially when utilized within obfuscated or encoded PowerShell blocks.

Impact

Successful abuse of this technique allows an attacker to spawn hidden or detached malicious processes that bypass standard shell interaction, facilitating persistence, credential dumping, or command-and-control communication while complicating traditional session-based monitoring.

Recommendation

Detection engineering teams should focus on PowerShell Script Block Logging (Event ID 4104) to capture the execution of the identified parameters.

• Deploy the provided Sigma rule to identify scripts executing 'Start-Process' with '-PassThru' and '-FilePath'.
• Enable PowerShell Script Block Logging across the enterprise to ensure the necessary telemetry is available for analysis.
• Establish an allowlist for known, legitimate administrative scripts that utilize this cmdlet to reduce false positives in a SOC environment.