Remote PowerShell Sessions Network Connections (WinRM)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•30

Detects inbound network connections to ports 5985 or 5986, which are commonly used for PowerShell Remoting (WinRM). This rule specifically looks for EventID 5156 (Windows Filtering Platform Connection) with a LayerRTID of 44, indicating an inbound connection.