Techniques
Sample rules
Powershell Remote Services Add TrustedHost
- source: splunk
- technicques:
- T1021.006
- T1021
Description
The following analytic detects the execution of a PowerShell script that modifies the ‘TrustedHosts’ configuration via EventCode 4104. It leverages PowerShell Script Block Logging to identify commands targeting WSMan settings, specifically those altering or concatenating trusted hosts. This activity is significant as it can indicate attempts to manipulate remote connection settings, potentially allowing unauthorized remote access. If confirmed malicious, this could enable attackers to establish persistent remote connections, bypass security protocols, and gain unauthorized access to sensitive systems and data.
Detection logic
`powershell` EventCode=4104 ScriptBlockText = "*WSMan:\\localhost\\Client\\TrustedHosts*" ScriptBlockText IN ("* -Value *", "* -Concatenate *")
| rename Computer as dest, UserID as user
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `powershell_remote_services_add_trustedhost_filter`