BIOC
Low
✕
64-bit PowerShell spawning a 32-bit PowerShell
Malware typically spawns 32-bit processes to work on as many hosts as possible. This case is therefore suspicious when it happens on a 64-bit host.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
Indicator:
Process action type = execution AND target process cmd != *noprofile -nologo -noninteractive -executionpolicy allsigned -command set-executionpolicy allsigned AND target process name = powershell.exe AND target process path = *syswow64* AND target process path != *windows\\ccm\\systemtemp\\* Process initiated by = powershell.exe AND initiator path = *system32* AND initiator path != *\\windows\\ccmcache\\*
Preventable: yes