Detection of PowerShell Remote Session Establishment

PowerShell is a standard administrative tool that is frequently abused by threat actors to perform lateral movement and remote code execution across enterprise networks. By using the New-PSSession cmdlet, attackers can establish persistent connections to remote hosts, allowing them to execute commands, stage additional malware, or exfiltrate data from compromised assets. This technique is often seen in the context of fileless attacks where malicious scripts are executed in memory. Monitoring for the creation of these sessions is critical for identifying unauthorized lateral movement and preventing the escalation of privileges within a domain environment. Defenders should focus on capturing PowerShell Script Block logs to gain visibility into the command structure and parameters used during these sessions.

Impact

Successful abuse of remote PowerShell sessions allows attackers to move laterally through an environment without the need for additional specialized tooling. This can lead to the compromise of sensitive data, domain-wide privilege escalation, and persistent access for threat actors. If left undetected, attackers can maintain control over multiple endpoints while avoiding traditional file-based detection mechanisms.

Recommendation

Prioritized actions for detection and prevention:

• Enable PowerShell Script Block Logging (Event ID 4104) across the environment to capture full command executions.
• Deploy the Sigma rule below to identify the use of New-PSSession with remote computer targets.
• Baseline legitimate administrative activity to reduce noise, specifically excluding known automation service accounts or management servers.
• Implement restrictive PowerShell constrained language mode where administrative requirements permit.