Skip to content
Threat Feed
Subscribe
low advisory

Windows: Non-interactive PowerShell process execution

Detection logic for identifying non-interactive PowerShell execution patterns by monitoring parent-child process relationships.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
Low
Action
Monitor or close
Sources
2 public sources
Freshness
Revision 1Nov 8, 02:14 UTC
Detection
1 rule
Source quality
A2Roughly even chance

This brief provides detection logic for identifying PowerShell (powershell.exe) or PowerShell Core (pwsh.exe) processes initiated without a standard user-interactive parent. While legitimate administrative and maintenance scripts often exhibit this behavior, it is a common technique used for obfuscated or automated execution of malicious payloads. Defenders should establish a baseline of expected parent processes before alerting.

Recommendation

  • Deploy the provided Sigma rule to identify PowerShell activity that deviates from common administrative or update-related parent processes.
  • Baseline the parent processes of PowerShell in your environment and maintain an allowlist to reduce noise from legitimate management tools.
  • Prioritize investigation of PowerShell processes spawned by non-standard parent processes, particularly those involving uncommon or unknown binary paths.

Immediate actions

Deploy Sigma rule as an informational hunt rule to baseline environment noise.

Detection Engineering 7d

Detection coverage 1

Non Interactive PowerShell Process Spawned

low

Detects non-interactive PowerShell activity by looking at the powershell process with parent processes that are typically not associated with user-interactive GUI sessions.

sigma tactics: execution techniques: T1059.001 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →