Execute Code with Pester.bat

Title: Execute Code with Pester.bat
Status: test
Description:Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
References:
  -https://twitter.com/Oddvarmoe/status/993383596244258816
  -https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
Author: Julia Fomina, oscd.community
Date: 2020-10-08
modified:2023-11-09
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1059.001'
• -'attack.t1216'

Logsource:

• category: process_creation
• product: windows

Detection:
  powershell_module:
    Image|endswith:
      -'\powershell.exe'
      -'\pwsh.exe'

    CommandLine|contains|all:
      -'Pester'
      -'Get-Help'

  cmd_execution:
    Image|endswith: '\cmd.exe'
    CommandLine|contains|all:
      -'pester'
      -';'

  get_help:
    CommandLine|contains:
      -'help'
      -'\?'

  condition:powershell_module or (cmd_execution and get_help)
Falsepositives:
  -Legitimate use of Pester for writing tests for Powershell scripts and modules
Level: medium