Uncommon PowerShell Hosts

{
  "selection": {
    "Data
| contains": "HostApplication="
  },
  "filter_main_ps": {
    "Data
| contains": [
      "HostApplication=?:/Windows/System32/WindowsPowerShell/v1.0/powershell",
      "HostApplication=?:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell",
      "HostApplication=?:\\Windows\\System32\\sdiagnhost.exe",
      "HostApplication=?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=?:\\Windows\\SysWOW64\\sdiagnhost.exe",
      "HostApplication=?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=powershell"
    ]
  },
  "filter_optional_citrix": {
    "Data
| contains": "Citrix\\ConfigSync\\ConfigSync.ps1"
  },
  "filter_optional_hexnode": {
    "Data
| contains": "HostApplication=C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

• ⚠ Programs using PowerShell directly without invocation of a dedicated interpreter
• ⚠ MSP Detection Searcher
• ⚠ Citrix ConfigSync.ps1