Potential Remote PowerShell Session Initiated

 1title: Potential Remote PowerShell Session Initiated
 2id: c539afac-c12a-46ed-b1bd-5a5567c9f045
 3status: test
 4description: |
 5    Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
 6    This could potentially indicates a remote PowerShell connection.    
 7references:
 8    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
 9author: Roberto Rodriguez @Cyb3rWard0g
10date: 2019-09-12
11modified: 2024-02-02
12tags:
13    - attack.execution
14    - attack.t1059.001
15    - attack.lateral-movement
16    - attack.t1021.006
17logsource:
18    category: network_connection
19    product: windows
20detection:
21    selection:
22        DestinationPort:
23            - 5985
24            - 5986
25        Initiated: 'true' # only matches of the initiating system can be evaluated
26        SourceIsIpv6: 'false'
27    filter_main_service_users:
28        - User|contains: # covers many language settings for Network Service. Please expand
29              - 'NETWORK SERVICE'
30              - 'NETZWERKDIENST'
31              - 'SERVICIO DE RED'
32              - 'SERVIZIO DI RETE'
33        - User|contains|all:
34              - 'SERVICE R'
35              - 'SEAU'
36    filter_main_localhost:
37        SourceIp:
38            - '::1'
39            - '127.0.0.1'
40        DestinationIp:
41            - '::1'
42            - '127.0.0.1'
43    filter_optional_avast:
44        Image:
45            - 'C:\Program Files\Avast Software\Avast\AvastSvc.exe'
46            - 'C:\Program Files (x86)\Avast Software\Avast\AvastSvc.exe'
47    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
48falsepositives:
49    - Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.
50    - Network Service user name of a not-covered localization
51level: high