Detection of Remote PowerShell Invoke-Command Execution

Adversaries frequently use legitimate administrative tools, such as the PowerShell Invoke-Command cmdlet, to conduct lateral movement across enterprise networks. By leveraging Windows Remote Management (WinRM), attackers can execute scripts and commands on remote systems without the need for additional malware installation. This technique, identified as T1021.006, allows actors to maintain persistence, collect information, or deploy additional payloads using existing system accounts. Defenders should focus on capturing PowerShell Script Block Logging events to identify the misuse of remoting capabilities in environments where such activity is not expected for standard administrative operations.

Impact

Successful abuse of Invoke-Command enables unauthorized code execution across the network, facilitating lateral movement and privilege escalation. This technique is commonly observed during the post-exploitation phase of intrusions, potentially leading to widespread data exfiltration, ransomware deployment, or long-term persistence within an affected sector.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across the environment to capture full command execution history.
• Deploy the provided Sigma rule to detect the specific combination of Invoke-Command and -ComputerName parameters in PowerShell scripts.
• Baseline administrative activity to distinguish between legitimate remote management workflows and suspicious actor behavior.