[metadata]
creation_date = "2020/11/24"
maturity = "production"
updated_date = "2020/11/24"

[rule]
author = ["Elastic"]
description = "Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows for running any Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement."
false_positives = [
    """
    PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to
    baseline your environment to determine the amount of noise to expect from this tool.
    """,
]
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.*"]
language = "eql"
license = "Elastic License"
name = "Incoming Execution via PowerShell Remoting"
references = ["https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1"]
risk_score = 43
rule_id = "2772264c-6fb9-4d9d-9014-b416eed21254"
severity = "medium"
tags = ["Elastic", "Host", "Windows", "Threat Detection", "Lateral Movement"]
type = "eql"

query = '''
sequence by host.id with maxspan = 30s
   [network where network.direction == "incoming" and destination.port in (5985, 5986) and
    network.protocol == "http" and source.address != "127.0.0.1" and source.address != "::1"
   ]
   [process where event.type == "start" and process.parent.name : "wsmprovhost.exe" and not process.name : "conhost.exe"]
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"


[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
