Detection rules › Sigma

Potential Remote PowerShell Session Initiated

Severity
high
Author
Roberto Rodriguez @Cyb3rWard0g
Source
upstream

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell
Lateral MovementT1021.006 Remote Services: Windows Remote Management

Event coverage

ProviderEvent IDTitle
Sysmon3Network connection

Stages and Predicates

Stage 1: selection

DestinationPort: [5985, 5986]
Initiated: true
SourceIsIpv6: false

Stage 2: not 1 of filter_main_*

or:
DestinationIp: [127.0.0.1, '::1']
SourceIp: [127.0.0.1, '::1']
User|contains: SEAU
User|contains: 'SERVICE R'
User|contains: 'NETWORK SERVICE'
User|contains: NETZWERKDIENST
User|contains: 'SERVICIO DE RED'
User|contains: 'SERVIZIO DI RETE'

Stage 3: not 1 of filter_optional_avast

Image: ['C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe', 'C:\Program Files\Avast Software\Avast\AvastSvc.exe']

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
DestinationIpeq
  • 127.0.0.1 corpus 2 (sigma 2)
  • ::1
DestinationPorteq
  • 5985 corpus 2 (sigma 2)
  • 5986 corpus 2 (sigma 2)
Imageeq
  • C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe
  • C:\Program Files\Avast Software\Avast\AvastSvc.exe
Initiatedeq
  • true corpus 40 (sigma 40)
SourceIpeq
  • 127.0.0.1 corpus 5 (sigma 5)
  • ::1 corpus 5 (sigma 5)
SourceIsIpv6eq
  • false
Usermatch
  • NETWORK SERVICE
  • NETZWERKDIENST
  • SEAU
  • SERVICE R
  • SERVICIO DE RED
  • SERVIZIO DI RETE