Detection of Potential Remote PowerShell Sessions via WinRM

This detection focuses on identifying potentially malicious remote management activity within a Windows environment. Windows Remote Management (WinRM) uses TCP ports 5985 (HTTP) and 5986 (HTTPS) to facilitate remote administration, including the execution of PowerShell commands across a network. Attackers frequently abuse this functionality to perform lateral movement or execute code on remote systems.

The detection logic monitors for network connections established to these specific ports. To reduce noise, it excludes legitimate traffic associated with the 'NETWORK SERVICE' account, which is the default service account for WinRM, as well as local-to-local traffic and specific security software processes like Avast. Security operations teams should use this telemetry to identify non-standard user accounts or unexpected processes initiating remote management sessions, which may indicate credential misuse or adversary movement.

Impact

Successful unauthorized use of remote PowerShell can lead to remote code execution, persistence, and lateral movement across a domain, potentially resulting in full compromise of host systems or sensitive data exfiltration.

Recommendation

• Deploy the provided Sigma rule to identify anomalous outbound network connections from workstations or servers that are not expected to perform remote administration.
• Enable Windows Filtering Platform (WFP) or network connection logging via Sysmon (Event ID 3) to capture source and destination port telemetry.
• Tune the exclusion filters to account for specific administrative tooling, automation scripts, or regional language variations of the 'NETWORK SERVICE' account name within your specific environment.