{"id":"60167e5c-84b2-4c95-a7ac-86281f27c445","title":"Remote PowerShell Session (PS Classic)","description":"Detects remote PowerShell sessions","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"low","date":"2019-08-10","modified":"2024-01-03","tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"technique_ids":["T1021.006","T1059.001"],"logsource":{"product":"windows","category":"ps_classic_start"},"falsepositives":["Legitimate use remote PowerShell sessions"],"references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"source_path":"rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml","source_sha256":"bfa7734fa20bdc4d8281dc4f83083ff6e4f3d050244cb0ef473ad8efd1d61aca","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote PowerShell Session (PS Classic)\nid: 60167e5c-84b2-4c95-a7ac-86281f27c445\nrelated:\n    - id: 96b9f619-aa91-478f-bacb-c3e50f8df575\n      type: derived\nstatus: test\ndescription: Detects remote PowerShell sessions\nreferences:\n    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html\nauthor: Roberto Rodriguez @Cyb3rWard0g\ndate: 2019-08-10\nmodified: 2024-01-03\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.lateral-movement\n    - attack.t1021.006\nlogsource:\n    product: windows\n    category: ps_classic_start\ndetection:\n    selection:\n        Data|contains|all:\n            - 'HostName=ServerRemoteHost'\n            - 'wsmprovhost.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate use remote PowerShell sessions\n# Note: Increase the level to \"medium\" in environments that do not leverage PowerShell remoting\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.006","id":"T1021.006","name":"Windows Remote Management","page":"techniques/enterprise/T1021.006/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/60167e5c-84b2-4c95-a7ac-86281f27c445.json","kind":"sigma"}