PowerShell Remote Session Creation
This rule detects the creation of a new PowerShell remote session using the 'New-PSSession' cmdlet, specifically when targeting a remote computer via the '-ComputerName' parameter. This activity can be indicative of an adversary establishing remote access or moving laterally within a network.
Sigma
