LoFP LoFP / legitimate use remote powershell sessions

Techniques

Sample rules

Remote PowerShell Session (PS Classic)

Description

Detects remote PowerShell sessions

Detection logic

condition: selection
selection:
  Data|contains|all:
  - HostName=ServerRemoteHost
  - wsmprovhost.exe

Remote PowerShell Session (PS Module)

Description

Detects remote PowerShell sessions

Detection logic

condition: selection and not 1 of filter_*
filter_pwsh_archive:
  ContextInfo|contains: \Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1
selection:
  ContextInfo|contains|all:
  - ' = ServerRemoteHost '
  - wsmprovhost.exe