sigmalowHunting

Remote PowerShell Session (PS Classic)

Detects remote PowerShell sessions

MITRE ATT&CK

executionlateral-movement

Detection Query

selection:
  Data|contains|all:
    - HostName=ServerRemoteHost
    - wsmprovhost.exe
condition: selection

Author

Roberto Rodriguez @Cyb3rWard0g

Created

2019-08-10

Data Sources

windowsps_classic_start

Platforms

windows

References

https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html

Tags

attack.executionattack.t1059.001attack.lateral-movementattack.t1021.006

Raw Content

title: Remote PowerShell Session (PS Classic)
id: 60167e5c-84b2-4c95-a7ac-86281f27c445
related:
    - id: 96b9f619-aa91-478f-bacb-c3e50f8df575
      type: derived
status: test
description: Detects remote PowerShell sessions
references:
    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-10
modified: 2024-01-03
tags:
    - attack.execution
    - attack.t1059.001
    - attack.lateral-movement
    - attack.t1021.006
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains|all:
            - 'HostName=ServerRemoteHost'
            - 'wsmprovhost.exe'
    condition: selection
falsepositives:
    - Legitimate use remote PowerShell sessions
# Note: Increase the level to "medium" in environments that do not leverage PowerShell remoting
level: low