PowerShell Execution of Batch Script

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•26

This rule detects PowerShell script blocks that attempt to execute batch scripts (.cmd or .bat files) using 'Start-Process'. This behavior can be indicative of an adversary abusing the Windows command shell for execution, potentially to run a series of commands or a malicious payload.