Convert indexed Sigma rules into analyst-ready detections.

title: Potential Remote PowerShell Session Initiated
id: c539afac-c12a-46ed-b1bd-5a5567c9f045
status: test
description: |
    Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
    This could potentially indicates a remote PowerShell connection.
references:
    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-09-12
modified: 2024-02-02
tags:
    - attack.execution
    - attack.t1059.001
    - attack.lateral-movement
    - attack.t1021.006
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 5985
            - 5986
        Initiated: 'true' # only matches of the initiating system can be evaluated
        SourceIsIpv6: 'false'
    filter_main_service_users:
        - User|contains: # covers many language settings for Network Service. Please expand
              - 'NETWORK SERVICE'
              - 'NETZWERKDIENST'
              - 'SERVICIO DE RED'
              - 'SERVIZIO DI RETE'
        - User|contains|all:
              - 'SERVICE R'
              - 'SEAU'
    filter_main_localhost:
        SourceIp:
            - '::1'
            - '127.0.0.1'
        DestinationIp:
            - '::1'
            - '127.0.0.1'
    filter_optional_avast:
        Image:
            - 'C:\Program Files\Avast Software\Avast\AvastSvc.exe'
            - 'C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.
    - Network Service user name of a not-covered localization
level: high