Incoming Execution via PowerShell Remoting

 1[metadata]
 2creation_date = "2020/11/24"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2024/04/08"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies remote execution via Windows PowerShell remoting. Windows PowerShell remoting allows a user to run any
13Windows PowerShell command on one or more remote computers. This could be an indication of lateral movement.
14"""
15false_positives = [
16    """
17    PowerShell remoting is a dual-use protocol that can be used for benign or malicious activity. It's important to
18    baseline your environment to determine the amount of noise to expect from this tool.
19    """,
20]
21from = "now-9m"
22index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-endpoint.events.network-*", "logs-windows.sysmon_operational-*"]
23language = "eql"
24license = "Elastic License v2"
25name = "Incoming Execution via PowerShell Remoting"
26references = [
27    "https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands?view=powershell-7.1",
28]
29risk_score = 47
30rule_id = "2772264c-6fb9-4d9d-9014-b416eed21254"
31severity = "medium"
32tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Tactic: Execution", "Data Source: Elastic Defend", "Data Source: Sysmon"]
33type = "eql"
34
35query = '''
36sequence by host.id with maxspan = 30s
37   [network where host.os.type == "windows" and network.direction : ("incoming", "ingress") and destination.port in (5985, 5986) and
38    network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
39   [process where host.os.type == "windows" and 
40    event.type == "start" and process.parent.name : "wsmprovhost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
41'''
42
43
44[[rule.threat]]
45framework = "MITRE ATT&CK"
46[[rule.threat.technique]]
47id = "T1021"
48name = "Remote Services"
49reference = "https://attack.mitre.org/techniques/T1021/"
50[[rule.threat.technique.subtechnique]]
51id = "T1021.006"
52name = "Windows Remote Management"
53reference = "https://attack.mitre.org/techniques/T1021/006/"
54
55[rule.threat.tactic]
56id = "TA0008"
57name = "Lateral Movement"
58reference = "https://attack.mitre.org/tactics/TA0008/"
59
60[[rule.threat]]
61framework = "MITRE ATT&CK"
62[[rule.threat.technique]]
63id = "T1059"
64name = "Command and Scripting Interpreter"
65reference = "https://attack.mitre.org/techniques/T1059/"
66[[rule.threat.technique.subtechnique]]
67id = "T1059.001"
68name = "PowerShell"
69reference = "https://attack.mitre.org/techniques/T1059/001/"
70
71
72[rule.threat.tactic]
73id = "TA0002"
74name = "Execution"
75reference = "https://attack.mitre.org/tactics/TA0002/"