{"id":"5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f","title":"PowerShell Web Access Installation - PsScript","description":"Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse","author":"Michael Haag","status":"test","level":"high","date":"2024-09-03","modified":"","tags":["attack.persistence","attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Legitimate PowerShell Web Access installations by administrators"],"references":["https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication","https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a","https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml","source_sha256":"995bb2ba86649e4244cbf8e69d1dc594427265fc917084acd6b910b4b099ff9a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Web Access Installation - PsScript\nid: 5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f\nstatus: test\ndescription: Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse\nreferences:\n    - https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication\n    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a\n    - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41\nauthor: Michael Haag\ndate: 2024-09-03\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection_install:\n        ScriptBlockText|contains: 'Install-WindowsFeature WindowsPowerShellWebAccess'\n    selection_config:\n        ScriptBlockText|contains: 'Install-PswaWebApplication'\n    selection_auth:\n        ScriptBlockText|contains|all:\n            - 'Add-PswaAuthorizationRule'\n            - '-UserName *'\n            - '-ComputerName *'\n    condition: 1 of selection_*\nfalsepositives:\n    - Legitimate PowerShell Web Access installations by administrators\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f.json","kind":"sigma"}