title: Suspicious PowerShell Invocation Based on Parent Process
id: 95eadcb2-92e4-4ed1-9031-92547773a6db
status: test
description: Detects suspicious powershell invocations from interpreters or unusual programs
author: Florian Roth
references:
  - https://www.carbonblack.com/2017/03/15/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/
date: 2019/01/16
modified: 2022/01/07
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    Image|endswith: '\powershell.exe'
  falsepositive:
    CurrentDirectory|contains: '\Health Service State\'
  condition: selection and not falsepositive
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Microsoft Operations Manager (MOM)
  - Other scripts
level: medium
tags:
  - attack.execution
  - attack.t1059.001
