Remote PowerShell Sessions

Hypothesis and description

According to ATT&CK, PowerShell can be used over WinRM to remotely run commands on a host. When a remote PowerShell session starts, svchost.exe executes wsmprovhost.exe

For this to work, certain registry keys must be set, and the WinRM service must be enabled. The PowerShell command Enter-PSSession -ComputerName \<RemoteHost\> creates a remote PowerShell session.

Platforms: Windows
Domain: Host, Network
Subtypes: Process
Submitted: 2014-11-19
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1059 Command and Scripting InterpreterT1059.001	Execution	Moderate
T1021 Remote ServicesT1021.006	Lateral Movement	Moderate

2 techniques, 4 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PLA Process Lineage Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

process = search Process:Create
wsmprovhost = filter process where (exe == "wsmprovhost.exe" and parent_exe == "svchost.exe")

EQLData model: EQL native

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "wsmprovhost.exe" and parent_process_name == "svchost.exe")

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\wsmprovhost.exe" parent_image="*\svchost.exe"

Across MITRE's defensive frameworks

Linked through the 2 ATT&CK techniques above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

14 more in the full list

View CAR-2014-11-004 on car.mitre.org

TTPCAR-2014-11-004