Windows PowerShell Script: Enable-PSRemoting Command Execution

title: "Windows PowerShell Script: Enable-PSRemoting Command Execution"
id: 16c68e11-03cc-423c-a584-e1c09b6c4803
status: test
description: This rule flags PowerShell script content that contains the Enable-PSRemoting command, indicating that Windows Remote Management (WinRM) remoting may be enabled. Attackers can use this capability for lateral movement and remote execution under the context of the logged-on user. It relies on Script Block Logging telemetry that records PowerShell script block text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml
author: frack113, Huntrule Team
date: 2022-01-07
tags:
  - attack.lateral-movement
  - attack.t1021.006
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmdlet:
    ScriptBlockText|contains: "Enable-PSRemoting "
  condition: selection_cmdlet
falsepositives:
  - Legitimate script
level: medium
license: DRL-1.1
related:
  - id: 991a9744-f2f0-44f2-bd33-9092eba17dc3
    type: derived