Detectionhightest
PowerShell Web Access Installation - PsScript
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script
Definition
Requirements: Script Block Logging must be enabled
Detection Logic
Detection Logic3 selectors
detection:
selection_install:
ScriptBlockText|contains: 'Install-WindowsFeature WindowsPowerShellWebAccess'
selection_config:
ScriptBlockText|contains: 'Install-PswaWebApplication'
selection_auth:
ScriptBlockText|contains|all:
- 'Add-PswaAuthorizationRule'
- '-UserName *'
- '-ComputerName *'
condition: 1 of selection_*False Positives
Legitimate PowerShell Web Access installations by administrators
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f
Status
test
Level
high
Type
Detection
Created
Tue Sep 03
Author
Path
rules/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml
Raw Tags
attack.persistenceattack.executionattack.t1059.001