Windows Remote PowerShell Session Start via wsmprovhost.exe (PS Classic)

Flags Windows telemetry indicating a remote PowerShell session startup using wsmprovhost.exe with a specified host parameter.

FreeUnreviewedSigmalowv1

windows-remote-powershell-session-start-via-wsmprovhost-exe-ps-classic-60167e5c

title: Windows Remote PowerShell Session Start via wsmprovhost.exe (PS Classic)
id: 91513bdd-e3e7-485a-b1b3-e2ee9379ccd4
related:
  - id: 96b9f619-aa91-478f-bacb-c3e50f8df575
    type: derived
  - id: 60167e5c-84b2-4c95-a7ac-86281f27c445
    type: derived
status: test
description: This rule identifies the start of remote PowerShell sessions on Windows by matching process activity where the command data includes HostName=ServerRemoteHost and wsmprovhost.exe. Remote PowerShell remoting is a common technique for interactive command execution and lateral movement, so monitoring its initialization can reveal attacker-controlled management sessions. It relies on Windows PowerShell Classic session start telemetry that records the session host parameters and the remoting provider process name.
references:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-10
modified: 2024-01-03
tags:
  - attack.execution
  - attack.t1059.001
  - attack.lateral-movement
  - attack.t1021.006
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains|all:
      - HostName=ServerRemoteHost
      - wsmprovhost.exe
  condition: selection
falsepositives:
  - Legitimate use remote PowerShell sessions
level: low
license: DRL-1.1

What it detects

This rule identifies the start of remote PowerShell sessions on Windows by matching process activity where the command data includes HostName=ServerRemoteHost and wsmprovhost.exe. Remote PowerShell remoting is a common technique for interactive command execution and lateral movement, so monitoring its initialization can reveal attacker-controlled management sessions. It relies on Windows PowerShell Classic session start telemetry that records the session host parameters and the remoting provider process name.

Known false positives

Legitimate use remote PowerShell sessions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.