Remote PowerShell Session (PS Classic)

Title: Remote PowerShell Session (PS Classic)
Status: test
Description:Detects remote PowerShell sessions
References:
  -https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
modified:2024-01-03
Tags:

• -'attack.execution'
• -'attack.t1059.001'
• -'attack.lateral-movement'
• -'attack.t1021.006'

Logsource:

• product: windows
• category: ps_classic_start

Detection:
  selection:
    Data|contains|all:
      -'HostName=ServerRemoteHost'
      -'wsmprovhost.exe'

  condition:selection
Falsepositives:
  -Legitimate use remote PowerShell sessions
Level: low