Incoming Execution via PowerShell Remoting

 1[metadata]
 2creation_date = "2020/11/24"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any
13Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.
14"""
15false_positives = [
16    """
17    PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to
18    baseline your environment to determine the amount of noise to expect from this tool.
19    """,
20]
21from = "now-9m"
22index = [
23    "winlogbeat-*",
24    "logs-endpoint.events.process-*",
25    "logs-endpoint.events.network-*",
26    "logs-windows.sysmon_operational-*",
27]
28language = "eql"
29license = "Elastic License v2"
30name = "Incoming Execution via PowerShell Remoting"
31references = [
32    "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1",
33]
34risk_score = 47
35rule_id = "2772264c-6fb9-4d9d-9014-b416eed21254"
36severity = "medium"
37tags = [
38    "Domain: Endpoint",
39    "OS: Windows",
40    "Use Case: Threat Detection",
41    "Tactic: Lateral Movement",
42    "Tactic: Execution",
43    "Data Source: Elastic Defend",
44    "Data Source: Sysmon",
45]
46type = "eql"
47
48query = '''
49sequence by host.id with maxspan = 30s
50   [network where host.os.type == "windows" and network.direction : ("incoming", "ingress") and destination.port in (5985, 5986) and
51    network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
52   [process where host.os.type == "windows" and 
53    event.type == "start" and process.parent.name : "wsmprovhost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
54'''
55
56
57[[rule.threat]]
58framework = "MITRE ATT&CK"
59[[rule.threat.technique]]
60id = "T1021"
61name = "Remote Services"
62reference = "https://attack.mitre.org/techniques/T1021/"
63[[rule.threat.technique.subtechnique]]
64id = "T1021.006"
65name = "Windows Remote Management"
66reference = "https://attack.mitre.org/techniques/T1021/006/"
67
68
69
70[rule.threat.tactic]
71id = "TA0008"
72name = "Lateral Movement"
73reference = "https://attack.mitre.org/tactics/TA0008/"
74[[rule.threat]]
75framework = "MITRE ATT&CK"
76[[rule.threat.technique]]
77id = "T1059"
78name = "Command and Scripting Interpreter"
79reference = "https://attack.mitre.org/techniques/T1059/"
80[[rule.threat.technique.subtechnique]]
81id = "T1059.001"
82name = "PowerShell"
83reference = "https://attack.mitre.org/techniques/T1059/001/"
84
85
86
87[rule.threat.tactic]
88id = "TA0002"
89name = "Execution"
90reference = "https://attack.mitre.org/tactics/TA0002/"