Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)

title: Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)
id: b4f7c92c-e724-4182-bc2a-401745f07f57
status: test
description: This rule identifies network connections with Initiated set to true where the process image ends with powershell.exe or pwsh.exe. Such behavior is commonly used by malicious scripts to retrieve additional payloads or communicate with command and control over external IPs and uncommon network paths. It relies on Windows network connection telemetry that includes the initiating process image and destination IP, and it applies exclusions for local/private address ranges and specific IP CIDR ranges to reduce noise.
references:
  - https://www.youtube.com/watch?v=DLtJTxMWZ2o
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/network_connection/net_connection_win_powershell_network_connection.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-13
modified: 2024-03-13
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    Initiated: "true"
  filter_main_local_ip:
    DestinationIp|cidr:
      - 127.0.0.0/8
      - 10.0.0.0/8
      - 169.254.0.0/16
      - 172.16.0.0/12
      - 192.168.0.0/16
      - ::1/128
      - fe80::/10
      - fc00::/7
    User|contains:
      - AUTHORI
      - AUTORI
  filter_main_msrange:
    DestinationIp|cidr:
      - 20.184.0.0/13
      - 51.103.210.0/23
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Administrative scripts
  - Microsoft IP range
  - Additional filters are required. Adjust to your environment (e.g. extend filters with company's ip range')
level: low
license: DRL-1.1
related:
  - id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
    type: derived