Change to category: ps_module

2021-10-16 08:05:15 +02:00
parent cb98a63453
commit 0ca16b18f4
20 changed files with 43 additions and 62 deletions
@@ -3,7 +3,7 @@ id: 96b9f619-aa91-478f-bacb-c3e50f8df575
 description: Detects remote PowerShell sessions
 status: test
 date: 2019/08/10
-modified: 2021/09/21
+modified: 2021/10/16
 author: Roberto Rodriguez @Cyb3rWard0g
 references:
    - https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html
@@ -16,11 +16,10 @@ tags:
    - attack.t1028  # an old one
 logsource:
    product: windows
-    service: powershell
+    category: ps_module
    definition: PowerShell Module Logging must be enabled
 detection:
    selection:
-        EventID: 4103 
        ContextInfo|contains|all:
            - ' = ServerRemoteHost ' #  HostName: 'ServerRemoteHost'  french : Nom d’hôte = 
            - 'wsmprovhost.exe'      #  HostApplication|contains: 'wsmprovhost.exe' french  Application hôte =