PowerShell Web Access Installation

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•3•0•25

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.