Remote PowerShell Session (PS Module)
Detects the initiation of remote PowerShell sessions by identifying specific keywords in the `ContextInfo` field of PowerShell module logs. It looks for the presence of ' = ServerRemoteHost ' and 'wsmprovhost.exe', which are indicative of a remote PowerShell connection. A filter is applied to exclude legitimate PowerShell archive module activity.
Sigma
