PowerShell spawns a credential prompt from a script-launched parent

Siemphony@siemphonymediumT1056.002unverifiedPlaybook · Privilege escalation

AN1440 asks for PowerShell used to mimic a UAC-style credential dialog from an unexpected parent. The rule matches PowerShell or pwsh invoking the two built-in ways a script raises a native Windows credential prompt — Get-Credential and the underlying PromptForCredential API — while the process itself was spawned from cmd.exe, wscript.exe or cscript.exe rather than a normal interactive shell, which is MITRE's ParentProcessName knob aimed at exactly this kind of script-chain launch. Cmdlet-name matching was chosen over MITRE's own CommandLine knob example (prompt text such as "Enter your password" or "CredentialRequired") because an API/cmdlet name is rarer in ordinary command lines than generic prompt wording; both of MITRE's example strings are now included in selection_prompt as well, so the rule covers its own chosen signal and MITRE's literal suggestion together. This selector only fires when Get-Credential or PromptForCredential (or one of MITRE's prompt-text strings) appears literally in PowerShell's own CommandLine — the directly typed or -Command-inlined invocation. It is blind to the same call delivered via -File <script>.ps1, where the cmdlet lives inside the script body and never appears in the parent process's CommandLine, or via -EncodedCommand, whose base64 payload by construction cannot contain a plaintext match — the two most common real-world PowerShell delivery mechanisms for scripted, non-interactive tooling. Closing that gap needs PowerShell Script Block Logging (EventID 4104), whose ScriptBlockText carries deobfuscated script content regardless of delivery mechanism, but 4104 is a distinct logsource without a ParentImage field, so folding it into this parent-scoped rule would require a second, differently-shaped analytic rather than extending this one. Script Block Logging is also off by default until Group Policy enables it, a prerequisite this rule does not assume and has not been built to use. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0521, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: PowerShell spawns a credential prompt from a script-launched parent2id: 8a3dcd34-7897-42b5-a281-0b4f4467d8063status: experimental4description: |5  AN1440 asks for PowerShell used to mimic a UAC-style credential dialog from6  an unexpected parent. The rule matches PowerShell or pwsh invoking the two7  built-in ways a script raises a native Windows credential prompt —8  Get-Credential and the underlying PromptForCredential API — while the9  process itself was spawned from cmd.exe, wscript.exe or cscript.exe rather10  than a normal interactive shell, which is MITRE's ParentProcessName knob11  aimed at exactly this kind of script-chain launch. Cmdlet-name matching was12  chosen over MITRE's own CommandLine knob example (prompt text such as13  "Enter your password" or "CredentialRequired") because an API/cmdlet name14  is rarer in ordinary command lines than generic prompt wording; both of15  MITRE's example strings are now included in selection_prompt as well, so16  the rule covers its own chosen signal and MITRE's literal suggestion17  together. This selector only fires when Get-Credential or18  PromptForCredential (or one of MITRE's prompt-text strings) appears19  literally in PowerShell's own CommandLine — the directly typed or20  -Command-inlined invocation. It is blind to the same call delivered via21  -File <script>.ps1, where the cmdlet lives inside the script body and never22  appears in the parent process's CommandLine, or via -EncodedCommand, whose23  base64 payload by construction cannot contain a plaintext match — the two24  most common real-world PowerShell delivery mechanisms for scripted,25  non-interactive tooling. Closing that gap needs PowerShell Script Block26  Logging (EventID 4104), whose ScriptBlockText carries deobfuscated script27  content regardless of delivery mechanism, but 4104 is a distinct logsource28  without a ParentImage field, so folding it into this parent-scoped rule29  would require a second, differently-shaped analytic rather than extending30  this one. Script Block Logging is also off by default until Group Policy31  enables it, a prerequisite this rule does not assume and has not been32  built to use.33  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0521, not hand-written and not tested by its author. Any lab result is on this rule's own page.34references:35  - https://attack.mitre.org/techniques/T1056/00236  - https://attack.mitre.org/detectionstrategies/DET052137author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)38date: 2026-08-1639tags:40  - attack.collection41  - attack.credential-access42  - attack.t1056.00243logsource:44  category: process_creation45  product: windows46detection:47  selection_script:48    Image|endswith:49      - '\powershell.exe'50      - '\pwsh.exe'51  selection_prompt:52    CommandLine|contains:53      - 'PromptForCredential'54      - 'Get-Credential'55      - 'Enter your password'56      - 'CredentialRequired'57  selection_parent:58    ParentImage|endswith:59      - '\cmd.exe'60      - '\wscript.exe'61      - '\cscript.exe'62  condition: selection_script and selection_prompt and selection_parent63falsepositives:64  - "Legacy deployment tooling (PDQ Deploy, SCCM task sequences, custom install wrappers) that launches a PowerShell Get-Credential prompt from a cmd.exe batch file for interactive software installs."65  - "A Scheduled Task action of the form cmd.exe /c powershell.exe -Command \"Get-Credential\" ..., used by legacy deployment tooling to collect a service-account credential inline rather than from a saved .ps1 file, which keeps Get-Credential literally in PowerShell's CommandLine and matches this selector by design."66level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "PromptForCredential" or ProcessCommandLine contains "Get-Credential" or ProcessCommandLine contains "Enter your password" or ProcessCommandLine contains "CredentialRequired")) and (InitiatingProcessFolderPath endswith "\\cmd.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*PromptForCredential*" OR CommandLine="*Get-Credential*" OR CommandLine="*Enter your password*" OR CommandLine="*CredentialRequired*")) AND (ParentImage="*\\cmd.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*promptforcredential*" OR TO_LOWER(process.command_line) LIKE "*get-credential*" OR TO_LOWER(process.command_line) LIKE "*enter your password*" OR TO_LOWER(process.command_line) LIKE "*credentialrequired*")) AND (TO_LOWER(process.parent.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cscript.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(PromptForCredential|Get-Credential|Enter your password|CredentialRequired)</field>    <field name="ParentImage" type="pcre2">(?i)(\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$)</field>    <description>PowerShell spawns a credential prompt from a script-launched parent</description>    <mitre>      <id>T1056.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8a3dcd34-7897-42b5-a281-0b4f4467d806

ATT&CKT1056.002

T1056.002GUI Input Capture

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1056.002, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific phrases to the selection_prompt to reduce false positives from legitimate scripts
Exclude specific parent images or command lines known to be used by legitimate software or administrative tasks
Consider adding a threshold for the number of times this behavior is seen within a certain timeframe to reduce noise from one-off events

Declared by the author

Legacy deployment tooling (PDQ Deploy, SCCM task sequences, custom install wrappers) that launches a PowerShell Get-Credential prompt from a cmd.exe batch file for interactive software installs.
A Scheduled Task action of the form cmd.exe /c powershell.exe -Command "Get-Credential" ..., used by legacy deployment tooling to collect a service-account credential inline rather than from a saved .ps1 file, which keeps Get-Credential literally in PowerShell's CommandLine and matches this selector by design.

Lessonprocess injection

process injectionAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects a specific behavior where PowerShell spawns a credential prompt from a script-launched parent process, which could be indicative of process injection techniques used by attackers to gain unauthorized access to sensitive information. The key factor that separates this behavior from normal activity is the combination of a PowerShell process spawned by a script launcher (such as cmd.exe, wscript.exe, or cscript.exe) and the presence of credential prompts in the command line.

02 · Telemetry you need

Log source: process creation events
Specific fields: Image, CommandLine, ParentImage
Audit settings: Process creation events should be audited, which may require enabling specific audit policies or settings in Windows, such as the "Audit Process Creation" policy.

03 · How the logic works

The rule works by selecting process creation events where the image ends with \powershell.exe or \pwsh.exe, indicating a PowerShell process. It then checks if the command line of the PowerShell process contains specific phrases related to credential prompts, such as PromptForCredential, Get-Credential, Enter your password, or CredentialRequired. Additionally, it verifies that the parent image of the PowerShell process ends with \cmd.exe, \wscript.exe, or \cscript.exe, indicating a script-launched parent. The condition requires all these selections to be true, meaning the rule only triggers when a PowerShell process with a credential prompt is spawned by a script launcher.

04 · Common false positives

Legitimate PowerShell scripts used for automation that require user input for credentials
System administration tools that utilize PowerShell and prompt for credentials
Software installation processes that use script launchers and PowerShell to configure or authenticate

05 · Detection maturity

tier_1: This rule as written may generate a significant number of false positives due to its broad selection criteria and lack of specific exclusions.
tier_2: With tuning, such as adding more specific phrases and exclusions, this rule can become more effective at detecting malicious activity while reducing noise.
tier_3: Correlating this rule with other signals, such as network activity or additional process creation events, can further enhance its maturity and provide a more comprehensive detection capability.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/8a3dcd34-7897-42b5-a281-0b4f4467d806

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell spawns a credential prompt from a script-launched parent

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it