PowerShell Web Access Installation - PsScript

Title: PowerShell Web Access Installation - PsScript
Status: test
Description:Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
References:
  -https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication
  -https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
  -https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
Author: Michael Haag
Date: 2024-09-03
modified:None
Tags:

• -'attack.persistence'
• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_install:
    ScriptBlockText|contains: 'Install-WindowsFeature WindowsPowerShellWebAccess'
  selection_config:
    ScriptBlockText|contains: 'Install-PswaWebApplication'
  selection_auth:
    ScriptBlockText|contains|all:
      -'Add-PswaAuthorizationRule'
      -'-UserName *'
      -'-ComputerName *'

  condition:1 of selection_*
Falsepositives:
  -Legitimate PowerShell Web Access installations by administrators
Level: high