Enable Windows Remote Management via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•43

This rule detects the execution of the PowerShell cmdlet 'Enable-PSRemoting'. This cmdlet configures the computer to receive PowerShell remote commands, which adversaries may use for lateral movement and remote execution. Detection relies on Script Block Logging being enabled to capture the cmdlet's execution.