title: Remote PowerShell Session
id: c539afac-c12a-46ed-b1bd-5a5567c9f045
description: Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account.
status: experimental
date: 2019/09/12
modified: 2020/08/24
author: Roberto Rodriguez @Cyb3rWard0g
references:
    - https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1086  # an old one
    - attack.lateral_movement
    - attack.t1021.006
    - attack.t1028  # an old one
logsource:
    category: network_connection
    product: windows
detection:
    selection: 
        DestinationPort:
            - 5985
            - 5986
    filter:
        User: 'NT AUTHORITY\NETWORK SERVICE'
    condition: selection and not filter
falsepositives:
    - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.
level: high
