Execute Code with Pester.bat as Parent

Title: Execute Code with Pester.bat as Parent
Status: test
Description:Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
References:
  -https://twitter.com/Oddvarmoe/status/993383596244258816
  -https://twitter.com/_st0pp3r_/status/1560072680887525378
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-20
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.001'
• -'attack.t1216'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_module:
    ParentImage|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    ParentCommandLine|contains: '\WindowsPowerShell\Modules\Pester\'
  selection_cli:
    ParentCommandLine|contains:
      -'{ Invoke-Pester -EnableExit ;'
      -'{ Get-Help "'

  condition:all of selection_*
Falsepositives:
  -Legitimate use of Pester for writing tests for Powershell scripts and modules
Level: medium