Windows PowerShell Initiated Network Connections

title: Windows PowerShell Initiated Network Connections
id: b4f7c92c-e724-4182-bc2a-401745f07f57
status: test
description: This rule flags network connections where the initiating process is PowerShell (powershell.exe or pwsh.exe) and the connection is marked as initiated. It helps identify potential attacker activity such as scripts downloading additional payloads or communicating with external infrastructure over specific destination ranges. The detection relies on Windows network connection telemetry that includes the initiating process image path, initiation state, and destination IP address.
references:
  - https://www.youtube.com/watch?v=DLtJTxMWZ2o
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_powershell_network_connection.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2024-03-13
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    Initiated: "true"
  filter_main_local_ip:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 169.254.0.0/16
      - 172.16.0.0/12
      - 192.168.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
    User|contains:
      - AUTHORI
      - AUTORI
  filter_main_msrange:
    DestinationIp|cidr:
      - 20.184.0.0/13
      - 51.103.210.0/23
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrative scripts
  - Microsoft IP range
  - Additional filters are required. Adjust to your environment (e.g. extend filters with company's ip range')
level: low
license: DRL-1.1
related:
  - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
    type: derived