PowerShell spawns a credential prompt from a script-launched parent

Siemphony@siemphonymediumT1056.002unverified

AN1440 asks for PowerShell used to mimic a UAC-style credential dialog from an unexpected parent. The rule matches PowerShell or pwsh invoking the two built-in ways a script raises a native Windows credential prompt — Get-Credential and the underlying PromptForCredential API — while the process itself was spawned from cmd.exe, wscript.exe or cscript.exe rather than a normal interactive shell, which is MITRE's ParentProcessName knob aimed at exactly this kind of script-chain launch. Cmdlet-name matching was chosen over MITRE's own CommandLine knob example (prompt text such as "Enter your password" or "CredentialRequired") because an API/cmdlet name is rarer in ordinary command lines than generic prompt wording; both of MITRE's example strings are now included in selection_prompt as well, so the rule covers its own chosen signal and MITRE's literal suggestion together. This selector only fires when Get-Credential or PromptForCredential (or one of MITRE's prompt-text strings) appears literally in PowerShell's own CommandLine — the directly typed or -Command-inlined invocation. It is blind to the same call delivered via -File <script>.ps1, where the cmdlet lives inside the script body and never appears in the parent process's CommandLine, or via -EncodedCommand, whose base64 payload by construction cannot contain a plaintext match — the two most common real-world PowerShell delivery mechanisms for scripted, non-interactive tooling. Closing that gap needs PowerShell Script Block Logging (EventID 4104), whose ScriptBlockText carries deobfuscated script content regardless of delivery mechanism, but 4104 is a distinct logsource without a ParentImage field, so folding it into this parent-scoped rule would require a second, differently-shaped analytic rather than extending this one. Script Block Logging is also off by default until Group Policy enables it, a prerequisite this rule does not assume and has not been built to use. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0521, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "PromptForCredential" or ProcessCommandLine contains "Get-Credential" or ProcessCommandLine contains "Enter your password" or ProcessCommandLine contains "CredentialRequired")) and (InitiatingProcessFolderPath endswith "\\cmd.exe" or InitiatingProcessFolderPath endswith "\\wscript.exe" or InitiatingProcessFolderPath endswith "\\cscript.exe"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*PromptForCredential*" OR CommandLine="*Get-Credential*" OR CommandLine="*Enter your password*" OR CommandLine="*CredentialRequired*")) AND (ParentImage="*\\cmd.exe" OR ParentImage="*\\wscript.exe" OR ParentImage="*\\cscript.exe"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*promptforcredential*" OR TO_LOWER(process.command_line) LIKE "*get-credential*" OR TO_LOWER(process.command_line) LIKE "*enter your password*" OR TO_LOWER(process.command_line) LIKE "*credentialrequired*")) AND (TO_LOWER(process.parent.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.parent.executable) LIKE "*\\\\cscript.exe"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(PromptForCredential|Get-Credential|Enter your password|CredentialRequired)</field>    <field name="ParentImage" type="pcre2">(?i)(\\cmd\.exe$|\\wscript\.exe$|\\cscript\.exe$)</field>    <description>PowerShell spawns a credential prompt from a script-launched parent</description>    <mitre>      <id>T1056.002</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: process_injection
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8a3dcd34-7897-42b5-a281-0b4f4467d806

ATT&CKT1056.002

T1056.002GUI Input Capture

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprocess injection

process injection

01 · What this rule detects

One process opening another and writing into its memory or steering its execution, so that attacker code runs inside a process the environment already trusts. The detectable part is rarely the payload — it is the precursors: a handle request carrying write and execute rights, a thread created in another process, or an image replaced after the process started. It matters because everything the injected code does afterwards is attributed to the host process, so a rule further down the chain will name the wrong binary.

02 · Telemetry you need

Sysmon EventID 10 (ProcessAccess) SourceImage, TargetImage, GrantedAccess and CallTrace — the access mask carries the signal, and CallTrace is only readable if symbol resolution is configured
Sysmon EventID 8 (CreateRemoteThread) SourceImage, TargetImage, StartAddress, StartModule, StartFunction
Sysmon EventID 25 (ProcessTampering) for image replacement and hollowing
Process creation with parentage — Sysmon EventID 1 carries CommandLine and ParentImage together; Security 4688 NewProcessName requires Audit Process Creation, and its CommandLine field needs the separate 'Include command line in process creation events' policy. Both are off by default
EDR API telemetry for VirtualAllocEx, WriteProcessMemory and APC queuing where the product exposes it — Windows itself does not log these calls

03 · How the logic works

The primary rule is a process-access rule: match EventID 10 where GrantedAccess includes the rights injection needs — write to memory, create a thread, operate the virtual memory of the target — and where TargetImage is a process worth injecting into. Note the trap: GrantedAccess is recorded as a hexadecimal string, and Sigma has no bitwise operator, so a rule written as an equality match only catches the exact masks you thought to enumerate. Either list the masks you actually observe from real tooling and revisit the list, or push the bit test down into the backend query where the language supports it. The remote-thread and tampering events are narrower and much quieter, so they make good standalone rules rather than filters on the first one. SourceImage is the field to anchor exclusions on; TargetImage is the field that decides whether an analyst should care.

04 · Common false positives

Endpoint protection and EDR agents, which inject and inspect by design — MsMpEng.exe and the equivalent vendor services
Windows Error Reporting (WerFault.exe) opening a crashing process with broad rights
Application performance monitoring and .NET or Java profilers that attach to instrument running code
Remote support, screen recording and accessibility software that hooks other applications, and VDI agents such as Citrix that hook the session
Debuggers attaching during development, including the just-in-time debugger

05 · Detection maturity

Tier 1 — starting point: Matches remote thread creation into any process, or a fixed list of access masks.
Tier 2 — tuned: Matches process access to a defined set of targets with injection-relevant rights, excluding security and diagnostic tooling by signed path.
Tier 3 — correlated: Correlates the access with the source process's own creation, signature status and what it did on the network afterwards.

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Exclude by the full signed path of SourceImage, never by filename — a copied binary in a temp directory keeps the filename
Keep the target list short and meaningful: browsers, LSASS, explorer.exe and your own line-of-business applications say more than a match on everything
Enumerate the access masks you see in your own environment before you write the match, and treat the list as something that ages
WerFault.exe will open almost anything with almost any rights — scope its exclusion to WerFault as the source, not to the target it touched
Raise severity when the source process is unsigned or was created in the same minute as the access

Declared by the author

Legacy deployment tooling (PDQ Deploy, SCCM task sequences, custom install wrappers) that launches a PowerShell Get-Credential prompt from a cmd.exe batch file for interactive software installs.
A Scheduled Task action of the form cmd.exe /c powershell.exe -Command "Get-Credential" ..., used by legacy deployment tooling to collect a service-account credential inline rather than from a saved .ps1 file, which keeps Get-Credential literally in PowerShell's CommandLine and matches this selector by design.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1056.002, evaluated against their process_creation events.

Share this rule

/u/siemphony/8a3dcd34-7897-42b5-a281-0b4f4467d806

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

PowerShell spawns a credential prompt from a script-launched parent

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it