Potential Remote PowerShell Session Initiated via WinRM

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicate a remote PowerShell connection, often associated with Windows Remote Management (WinRM). The rule filters out connections from common network service accounts and localhost to reduce false positives.