PowerShell Remote Session Creation

calendar Nov 2, 2023 · attack.execution attack.t1059.001  ·
Share on: linkedin copy

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

Sigma rule (View on GitHub)

 1title: PowerShell Remote Session Creation
 2id: a0edd39f-a0c6-4c17-8141-261f958e8d8f
 3status: test
 4description: |
 5    Adversaries may abuse PowerShell commands and scripts for execution.
 6    PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system    
 7references:
 8    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-10---powershell-invoke-downloadcradle
 9    - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7.2
10author: frack113
11date: 2022/01/06
12modified: 2023/01/02
13tags:
14    - attack.execution
15    - attack.t1059.001
16logsource:
17    product: windows
18    category: ps_script
19    definition: 'Requirements: Script Block Logging must be enabled'
20detection:
21    selection:
22        ScriptBlockText|contains|all:
23            - 'New-PSSession'
24            - '-ComputerName '
25    condition: selection
26falsepositives:
27    - Legitimate administrative script
28level: medium

References

  • atomic-red-team/atomics/T1059.001/T1059.001.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

    Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team


    Read More

  • New-PSSession (Microsoft.PowerShell.Core) - PowerShell

    The New-PSSession cmdlet creates a PowerShell session (PSSession) on a local or remote computer. When you create a PSSession, PowerShell establishes a persistent connection to the remote computer. Use a PSSession to run multiple commands that share data, such as a function or the value of a variable. To run commands in a PSSession, use the Invoke-Command cmdlet. To use the PSSession to interact directly with a remote computer, use the Enter-PSSession cmdlet. For more information, see about_PSSessions. You can run commands on a remote computer without creating a PSSession with the ComputerName parameters of Enter-PSSession or Invoke-Command. When you use the ComputerName parameter, PowerShell creates a temporary connection that is used for the command and is then closed. Starting with PowerShell 6.0 you can use Secure Shell (SSH) to establish a connection to and create a session on a remote computer, if SSH is available on the local computer and the remote computer is configured with a PowerShell SSH endpoint. The benefit of an SSH based PowerShell remote session is that it can work across multiple platforms (Windows, Linux, macOS). For SSH based sessions you use the HostName or SSHConnection parameter set to specify the remote computer and relevant connection information. For more information about how to set up PowerShell SSH remoting, see PowerShell Remoting Over SSH. Note When using WSMan remoting from a Linux or macOS client with a HTTPS endpoint where the server certificate is not trusted (e.g., a self-signed certificate). You must provide a PSSessionOption that includes the SkipCACheck and SkipCNCheck values set to $true to successfully establish the connection. Only do this if you are in an environment where you can be certain of the server certificate and the network connection to the target system.


    Read More

Related rules

to-top