Potential Remote PowerShell Session Initiated

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule potential_remote_powershell_session_initiated {

  meta:
    author = "Roberto Rodriguez @Cyb3rWard0g"
    description = "Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection."
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "Potential Remote PowerShell Session Initiated"
    sigma_uuid = "c539afac-c12a-46ed-b1bd-5a5567c9f045"
    sigma_status = "test"
    rule_id = "mr_7186feaf-ab01-4c41-b17f-994b08b5bc33"
    tactic = "TA0008"
    technique = "T1021.006"
    type = "Hunt"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Legitimate usage of remote PowerShell, e.g. remote administration and monitoring. Network Service user name of a not-covered localization"

  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.metadata.product_event_type = "3"
    $net.metadata.product_name = "Microsoft-Windows-Sysmon"
    $net.metadata.vendor_name = "Microsoft"
    (
        $net.target.port = 5985 or
        $net.target.port = 5986
    )
    //Parser extension added for Initiated/true field/value, not currently in Sysmon parser
    //Initiated: 'true'
    $net.additional.fields["Initiated"] = "true"
    net.ip_in_range_cidr($net.principal.ip, "0.0.0.0/0")
    NOT (
        strings.contains(strings.to_upper($net.principal.user.userid), "NETWORK SERVICE") or
        strings.contains(strings.to_upper($net.principal.user.userid), "NETZWERKDIENST") or
        strings.contains(strings.to_upper($net.principal.user.userid), "SERVICIO DE RED") or
        strings.contains(strings.to_upper($net.principal.user.userid), "SERVIZIO DI RETE")
        or
        (
            strings.contains(strings.to_upper($net.principal.user.userid), "SERVICE R") and
            strings.contains(strings.to_upper($net.principal.user.userid), "SEAU")
        )
    )
    NOT (
        $net.principal.ip = "::1" or
        $net.principal.ip = "127.0.0.1" or
        $net.target.ip = "::1" or
        $net.target.ip = "127.0.0.1"
    )
    NOT (
        $net.principal.process.file.full_path = "C:\\Program Files\\Avast Software\\Avast\\AvastSvc.exe" nocase or
        $net.principal.process.file.full_path = "C:\\Program Files (x86)\\Avast Software\\Avast\\AvastSvc.exe" nocase
    )

    $net.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($net.principal.user.userid = "user" and $net.principal.hostname = "hostname", 0, 15))
    $principal_ip = array_distinct($net.principal.ip)
    $principal_port = array_distinct($net.principal.port)
    $principal_process_pid = array_distinct($net.principal.process.pid)
    $principal_process_command_line = array_distinct($net.principal.process.command_line)
    $principal_process_file_sha256 = array_distinct($net.principal.process.file.sha256)
    $principal_process_file_full_path = array_distinct($net.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($net.principal.process.product_specific_process_id)
    $principal_process_parent_process_product_specific_process_id = array_distinct($net.principal.process.parent_process.product_specific_process_id)
    $principal_user_userid = array_distinct($net.principal.user.userid)
    $target_ip = array_distinct($net.target.ip)
    $target_port = array_distinct($net.target.port)

  condition:
    $net
}