Possible Remote PowerShell Session (PS Classic) (via ps_classic_start)

title: Possible Remote PowerShell Session (PS Classic) (via ps_classic_start)
id: e45a0404-26ee-5e4b-873e-c5c9ed7c0867
status: stable
description: This rule detects remote PowerShell sessions
references:
    - https://attack.mitre.org/techniques/T1021/006/
    - https://attack.mitre.org/techniques/T1059/001/
    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
author: Huntrule Team
date: 2026-05-27
tags:
    - attack.execution
    - attack.t1059.001
    - attack.lateral-movement
    - attack.t1021.006
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection:
        Data|contains|all:
            - 'HostName=ServerRemoteHost'
            - 'wsmprovhost.exe'
    condition: selection
falsepositives:
    - Unknown
level: low