PowerShell script block suppresses errors around a download or exec cmdlet

Siemphony@siemphonylowT1564.011unverified

AN0182 describes PowerShell invoked with parameters that suppress errors or interrupts so a command keeps running through failures that would otherwise stop it. `-ErrorAction SilentlyContinue` alone is far too common to gate on — it is defensive-programming boilerplate in a huge share of legitimate scripts — so this rule requires it to appear in the same script block as one of MITRE's `MonitoredCmdlets` examples (`Invoke-Expression`, `Invoke-WebRequest`) plus the other primitives that make up the same download-and-run pattern (`Invoke-RestMethod`, `Net.WebClient`, `DownloadString`, `Start-BitsTransfer`). The idea is that an adversary chaining a retrieval or execution step behind silenced errors is trying to keep a cradle running past a blocked request or a killed connection, which is a narrower claim than "a script suppressed an error somewhere." This rule does not attempt AN0182's `ErrorActionThreshold` knob — a frequency count across a time window is not expressible against a single event in lib/sigma — so it fires on the first block that matches rather than a repeated pattern. PowerShell Script Block Logging is off by default and is not enabled by the Microsoft or CIS baselines, so without the *Turn on PowerShell Script Block Logging* policy this rule returns zero rows because the host is blind, not because nothing happened. The brief's other Windows leg (Sysmon EventID 1 `process_creation`) is not combined here: it carries `CommandLine` but not the full script text, so it cannot see an `-ErrorAction` flag set inside a script rather than on the command line, and AN0181/AN0183's Linux `nohup`/macOS `disown` legs are a different logsource entirely and are not covered by this rule. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0067, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "-ErrorAction SilentlyContinue" or ScriptBlockText contains "-ErrorAction Ignore" or ScriptBlockText contains "-EA SilentlyContinue" or ScriptBlockText contains "-EA Ignore")) and (ScriptBlockText contains "Invoke-Expression" or ScriptBlockText contains "Invoke-WebRequest" or ScriptBlockText contains "Invoke-RestMethod" or ScriptBlockText contains "Net.WebClient" or ScriptBlockText contains "DownloadString" or ScriptBlockText contains "Start-BitsTransfer"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*-ErrorAction SilentlyContinue*" OR ScriptBlockText="*-ErrorAction Ignore*" OR ScriptBlockText="*-EA SilentlyContinue*" OR ScriptBlockText="*-EA Ignore*")) AND (ScriptBlockText="*Invoke-Expression*" OR ScriptBlockText="*Invoke-WebRequest*" OR ScriptBlockText="*Invoke-RestMethod*" OR ScriptBlockText="*Net.WebClient*" OR ScriptBlockText="*DownloadString*" OR ScriptBlockText="*Start-BitsTransfer*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*-erroraction silentlycontinue*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-erroraction ignore*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-ea silentlycontinue*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-ea ignore*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-expression*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-webrequest*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-restmethod*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*net.webclient*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*downloadstring*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*start-bitstransfer*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(-ErrorAction SilentlyContinue|-ErrorAction Ignore|-EA SilentlyContinue|-EA Ignore)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Invoke-Expression|Invoke-WebRequest|Invoke-RestMethod|Net\.WebClient|DownloadString|Start-BitsTransfer)</field>    <description>PowerShell script block suppresses errors around a download or exec cmdlet</description>    <mitre>      <id>T1564.011</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: low
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1230755c-8a57-4cb4-ab5a-45fc3b10d70c

ATT&CKT1564.011

T1564.011Ignore Process Interrupts

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

A single PowerShell Script Block Logging event (EventID 4104) that contains both an error-suppression flag and a download-or-execute cmdlet in the same block. AN0182 describes error/interrupt suppression used to keep a command running past a failure it would otherwise stop on. -ErrorAction SilentlyContinue alone is ordinary defensive scripting, so this rule refuses to fire on it in isolation — it requires the flag to sit next to one of MITRE's MonitoredCmdlets examples (Invoke-Expression, Invoke-WebRequest) or a related download/exec primitive the pipeline added (Invoke-RestMethod, Net.WebClient, DownloadString, Start-BitsTransfer). The claim is narrow on purpose: a retrieval or exec step deliberately silenced against failure, not "a script suppressed an error somewhere."

02 · Telemetry you need

product: windows, service: powershell, EventID 4104. Script Block Logging is off by default and is not turned on by either the Microsoft or CIS baselines — without the Turn on PowerShell Script Block Logging GPO, this rule returns zero rows because the host is blind, not because nothing happened. The brief's Sysmon EventID 1 leg is deliberately not combined here: CommandLine doesn't carry the full script body, so it can't see an -ErrorAction flag set inside a script rather than typed on the command line.

03 · How the logic works

Three selections, ANDed:

Both contains blocks are checked against one event's ScriptBlockText, so the rule needs the flag and the cmdlet to land in the same fragment of the same block. That is a real blind spot: 4104 splits script blocks over roughly 1KB into multiple sequential events sharing one ScriptBlockId (MessageNumber/MessageTotal), and each fragment carries only its own slice of text. A large or heavily-formatted dropper that puts the suppression flag and the download cmdlet in different fragments never produces a single event where both selections match — and that is precisely the shape of the most obfuscated real-world scripts. AN0182's ErrorActionThreshold knob — a repeat-count over a time window — is also not attempted; lib/sigma has no aggregation, so this fires on the first matching block rather than a pattern of repeated suppression.

04 · Common false positives

The false positives are all legitimate "keep going on failure" patterns that happen to use the same vocabulary: installer/provisioning scripts that probe an optional endpoint with Invoke-WebRequest -ErrorAction SilentlyContinue and fall back quietly; configuration-management agents (DSC, Chef, Puppet, Ansible) wrapping idempotent download-and-apply steps the same way so re-runs don't fail on stale state; admin-written health-check scripts calling Invoke-RestMethod against an internal API with errors suppressed so one dead endpoint doesn't abort a larger job; and documentation or code comments logged verbatim by 4104 that mention the combination without ever executing it. level: low reflects that the highest-volume matches are expected to be benign.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from DET0067 and never run against a log line. The cmdlet list, the suppression flags and the level are all pipeline choices, not MITRE values; only the two MonitoredCmdlets examples trace back to the brief.
tier_2: needs a corpus of real 4104 events from your own provisioning tooling to see which false positives actually dominate before any threshold or exclusion is trustworthy.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Narrow the cmdlet list to what your estate actually treats as suspicious — Start-BitsTransfer inside routine deployment tooling is common and can often be dropped first. Pair a hit with the parent process from 4103/EID1: a suppressed download cmdlet launched from cmd.exe or a macro host is a different case than one inside a signed DSC or SCCM script. Exclude known script paths (deployment share, agent install directory) by hash or ScriptBlockId rather than by cmdlet. If your logging pipeline can join fragments by ScriptBlockId before matching, do — it closes the fragmentation gap the rule can't close on its own.

Declared by the author

Deployment and installer scripts that probe for an optional module, proxy or update endpoint with Invoke-WebRequest -ErrorAction SilentlyContinue and fall back silently when it is unreachable, which is a standard pattern in provisioning tooling and CI/CD runbooks.
Configuration-management agents (DSC, Chef, Puppet, Ansible's PowerShell modules) that wrap idempotent download-and-apply steps in SilentlyContinue so a re-run does not fail on a resource that already exists or a mirror that is temporarily down.
Administrator-authored monitoring or health-check scripts that call Invoke-RestMethod against an internal API with suppressed errors so a single unreachable endpoint does not abort a larger scheduled task.
Documentation, help text and code samples logged verbatim by 4104: a runbook or module comment that discusses this exact combination of flag and cmdlet, without executing either, produces an identical script block.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.011, evaluated against their — events.

Share this rule

/u/siemphony/1230755c-8a57-4cb4-ab5a-45fc3b10d70c

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell script block suppresses errors around a download or exec cmdlet

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it