Windows PowerShell ScriptBlock New-PSSession Remote Session Creation

title: Windows PowerShell ScriptBlock New-PSSession Remote Session Creation
id: 349f1d2a-47be-4167-906a-f6817383d223
status: test
description: This rule flags PowerShell script block content that includes creating a remote session by matching the use of New-PSSession with a ComputerName argument. Attackers commonly use PowerShell remoting to execute commands on remote systems while blending into legitimate administrative workflows. The detection relies on Windows PowerShell script block text telemetry (with Script Block Logging enabled) capturing the relevant command text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-10---powershell-invoke-downloadcradle
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7.4
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml
author: frack113, Huntrule Team
date: 2022-01-06
modified: 2023-01-02
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - New-PSSession
      - "-ComputerName "
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: a0edd39f-a0c6-4c17-8141-261f958e8d8f
    type: derived