{"id":"c539afac-c12a-46ed-b1bd-5a5567c9f045","title":"Potential Remote PowerShell Session Initiated","description":"Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.\nThis could potentially indicates a remote PowerShell connection.\n","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-09-12","modified":"2024-02-02","tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"technique_ids":["T1021.006","T1059.001"],"logsource":{"category":"network_connection","product":"windows"},"falsepositives":["Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.","Network Service user name of a not-covered localization"],"references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"source_path":"rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml","source_sha256":"8d4e99279a9d38affb04c5ced3615555f2d72617c14677682d2f0054eef0c537","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Remote PowerShell Session Initiated\nid: c539afac-c12a-46ed-b1bd-5a5567c9f045\nstatus: test\ndescription: |\n    Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.\n    This could potentially indicates a remote PowerShell connection.\nreferences:\n    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html\nauthor: Roberto Rodriguez @Cyb3rWard0g\ndate: 2019-09-12\nmodified: 2024-02-02\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.lateral-movement\n    - attack.t1021.006\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        DestinationPort:\n            - 5985\n            - 5986\n        Initiated: 'true' # only matches of the initiating system can be evaluated\n        SourceIsIpv6: 'false'\n    filter_main_service_users:\n        - User|contains: # covers many language settings for Network Service. Please expand\n              - 'NETWORK SERVICE'\n              - 'NETZWERKDIENST'\n              - 'SERVICIO DE RED'\n              - 'SERVIZIO DI RETE'\n        - User|contains|all:\n              - 'SERVICE R'\n              - 'SEAU'\n    filter_main_localhost:\n        SourceIp:\n            - '::1'\n            - '127.0.0.1'\n        DestinationIp:\n            - '::1'\n            - '127.0.0.1'\n    filter_optional_avast:\n        Image:\n            - 'C:\\Program Files\\Avast Software\\Avast\\AvastSvc.exe'\n            - 'C:\\Program Files (x86)\\Avast Software\\Avast\\AvastSvc.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.\n    - Network Service user name of a not-covered localization\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.006","id":"T1021.006","name":"Windows Remote Management","page":"techniques/enterprise/T1021.006/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/c539afac-c12a-46ed-b1bd-5a5567c9f045.json","kind":"sigma"}