Potential Remote PowerShell Session Initiated
This rule detects network connections initiated by a process over ports 5985 (HTTP) or 5986 (HTTPS), which are commonly used for Windows Remote Management (WinRM) and PowerShell Remoting. The rule specifically looks for these connections originating from non-network service accounts, as connections from such accounts could indicate a suspicious remote PowerShell session. It excludes connections from localhost and known legitimate antivirus processes to reduce false positives.
YARA-L
