frack113
29 lines
970 B
YAML
29 lines
970 B
YAML
title: Remote PowerShell Session
|
||
id: 96b9f619-aa91-478f-bacb-c3e50f8df575
|
||
description: Detects remote PowerShell sessions
|
||
status: test
|
||
date: 2019/08/10
|
||
modified: 2021/10/16
|
||
author: Roberto Rodriguez @Cyb3rWard0g
|
||
references:
|
||
- https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190511223310.html
|
||
tags:
|
||
- attack.execution
|
||
- attack.t1059.001
|
||
- attack.t1086 # an old one
|
||
- attack.lateral_movement
|
||
- attack.t1021.006
|
||
- attack.t1028 # an old one
|
||
logsource:
|
||
product: windows
|
||
category: ps_module
|
||
definition: PowerShell Module Logging must be enabled
|
||
detection:
|
||
selection:
|
||
ContextInfo|contains|all:
|
||
- ' = ServerRemoteHost ' # HostName: 'ServerRemoteHost' french : Nom d’hôte =
|
||
- 'wsmprovhost.exe' # HostApplication|contains: 'wsmprovhost.exe' french Application hôte =
|
||
condition: selection
|
||
falsepositives:
|
||
- Legitimate use remote PowerShell sessions
|
||
level: high |