title: Remote PowerShell Session
id: c539afac-c12a-46ed-b1bd-5a5567c9f045
status: test
description: Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account.
author: Roberto Rodriguez @Cyb3rWard0g
references:
  - https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html
date: 2019/09/12
modified: 2022/02/16
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 5985
      - 5986
  filter:
    User|contains: 
      - 'AUTHORI'
      - 'AUTORI'
  condition: selection and not filter
falsepositives:
  - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.lateral_movement
  - attack.t1021.006
