---
title: PowerShell spawning Cmd
description: Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe. Rule type: query Rule indices: winlogbeat-*, logs-endpoint.events.*,...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/_deprecated/execution_command_shell_started_by_powershell
products:
  - Elastic Security
---

# PowerShell spawning Cmd
<warning>
  This rule has been deprecated as of 2021/04/15.
</warning>

Identifies a suspicious parent child process relationship with cmd.exe descending from PowerShell.exe.
**Rule type**: query
**Rule indices**:
- winlogbeat-*
- logs-endpoint.events.*
- logs-windows.*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
**Tags**:
- Elastic
- Host
- Windows
- Threat Detection
- Execution

**Version**: 100
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```kuery
event.category:process and event.type:(start or process_started) and
  process.parent.name:powershell.exe and process.name:cmd.exe
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Command and Scripting Interpreter
  - Id: T1059
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/](https://attack.mitre.org/techniques/T1059/)](https://attack.mitre.org/techniques/T1059/)
- Sub Technique:
  - Name: PowerShell
  - Id: T1059.001
  - Reference URL: [[https://attack.mitre.org/techniques/T1059/001/](https://attack.mitre.org/techniques/T1059/001/)](https://attack.mitre.org/techniques/T1059/001/)