Detection rules › Sigma
Potential Remote PowerShell Session Initiated
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Lateral Movement | T1021.006 Remote Services: Windows Remote Management |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 3 | Network connection |
Stages and Predicates
Stage 1: selection
DestinationPort: [5985, 5986]
Initiated: true
SourceIsIpv6: false
Stage 2: not 1 of filter_main_*
or:
DestinationIp: [127.0.0.1, '::1']
SourceIp: [127.0.0.1, '::1']
User|contains: SEAU
User|contains: 'SERVICE R'
User|contains: 'NETWORK SERVICE'
User|contains: NETZWERKDIENST
User|contains: 'SERVICIO DE RED'
User|contains: 'SERVIZIO DI RETE'
Stage 3: not 1 of filter_optional_avast
Image: ['C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe', 'C:\Program Files\Avast Software\Avast\AvastSvc.exe']
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
DestinationIp | eq |
|
DestinationPort | eq |
|
Image | eq |
|
Initiated | eq |
|
SourceIp | eq |
|
SourceIsIpv6 | eq |
|
User | match |
|