Remote PowerShell Sessions Network Connections (WinRM)

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986