Remote PowerShell Session (PS Module)

Title: Remote PowerShell Session (PS Module)
Status: test
Description:Detects remote PowerShell sessions
References:
  -https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Date: 2019-08-10
modified:2023-01-20
Tags:

• -'attack.execution'
• -'attack.t1059.001'
• -'attack.lateral-movement'
• -'attack.t1021.006'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection:
    ContextInfo|contains|all:
      -' = ServerRemoteHost '
      -'wsmprovhost.exe'

  filter_pwsh_archive:
    ContextInfo|contains: '\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1'
  condition:selection and not 1 of filter_*
Falsepositives:
  -Legitimate use remote PowerShell sessions
Level: high