Remote PowerShell Session (PS Classic) — Sigma Rule

Rule metadata and linked tags

Author: Roberto Rodriguez @Cyb3rWard0g. Source status: test; severity: low. Source dates: 2019-08-10 / 2024-01-03.

{
  "product": "windows",
  "category": "ps_classic_start"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: bfa7734fa20bdc4d8281dc4f83083ff6e4f3d050244cb0ef473ad8efd1d61aca

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Remote PowerShell Session (PS Classic)
id: 60167e5c-84b2-4c95-a7ac-86281f27c445
related:
    - id: 96b9f619-aa91-478f-bacb-c3e50f8df575
      type: derived
status: test
description: Detects remote PowerShell sessions
references:
    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-10
modified: 2024-01-03
tags:
    - attack.execution
    - attack.t1059.001
    - attack.lateral-movement
    - attack.t1021.006
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains|all:
            - 'HostName=ServerRemoteHost'
            - 'wsmprovhost.exe'
    condition: selection
falsepositives:
    - Legitimate use remote PowerShell sessions
# Note: Increase the level to "medium" in environments that do not leverage PowerShell remoting
level: low

Original YAML and metadata in JSON

False positives

• Legitimate use remote PowerShell sessions

Source references

• https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html