Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

PowerShell Remote Session Creation

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Thu Jan 06Updated Mon Jan 02a0edd39f-a0c6-4c17-8141-261f958e8d8fwindows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'New-PSSession'
            - '-ComputerName '
    condition: selection
False Positives

Legitimate administrative script

References
1
Resolving title…
github.com
2
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Rule Metadata
Rule ID
a0edd39f-a0c6-4c17-8141-261f958e8d8f
Status
test
Level
medium
Type
Detection
Created
Thu Jan 06
Modified
Mon Jan 02
Author
François Hubaut
Path
rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml
Raw Tags
attack.executionattack.t1059.001
View on GitHub