Windows PowerShell Remote Session Module Context Indicator (wsmprovhost.exe)

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.

FreeUnreviewedSigmahighv1

windows-powershell-remote-session-module-context-indicator-wsmprovhost-exe-96b9f619

title: Windows PowerShell Remote Session Module Context Indicator (wsmprovhost.exe)
id: 8bb4c295-b84a-497a-8330-00537eddfa39
status: test
description: This rule identifies remote PowerShell activity by matching PowerShell module context information that includes a remote host indicator and the wsmprovhost.exe process context. Attackers often use remote PowerShell to run commands on other systems for execution and lateral movement while leveraging built-in management functionality. The detection relies on Windows PowerShell module telemetry that records ContextInfo and can include specific module path substrings for the PowerShell Archive module, which are used for exclusion filtering.
references:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml
author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton, Huntrule Team
date: 2019-08-10
modified: 2023-01-20
tags:
  - attack.execution
  - attack.t1059.001
  - attack.lateral-movement
  - attack.t1021.006
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    ContextInfo|contains|all:
      - " = ServerRemoteHost "
      - wsmprovhost.exe
  filter_pwsh_archive:
    ContextInfo|contains: \Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate use remote PowerShell sessions
level: high
license: DRL-1.1
related:
  - id: 96b9f619-aa91-478f-bacb-c3e50f8df575
    type: derived

What it detects

This rule identifies remote PowerShell activity by matching PowerShell module context information that includes a remote host indicator and the wsmprovhost.exe process context. Attackers often use remote PowerShell to run commands on other systems for execution and lateral movement while leveraging built-in management functionality. The detection relies on Windows PowerShell module telemetry that records ContextInfo and can include specific module path substrings for the PowerShell Archive module, which are used for exclusion filtering.

Known false positives

Legitimate use remote PowerShell sessions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.