Remote PowerShell Session (PS Module) (96b9f619-aa91-478f-bacb-c3e50f8df575)

Detects remote PowerShell sessions

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Remote PowerShell Session (PS Module) (96b9f619-aa91-478f-bacb-c3e50f8df575)	Sigma-Rules	1
Remote PowerShell Session (PS Module) (96b9f619-aa91-478f-bacb-c3e50f8df575)	Sigma-Rules	Windows Remote Management - T1021.006 (60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65)	Attack Pattern	1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba)	Attack Pattern	Windows Remote Management - T1021.006 (60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65)	Attack Pattern	2