Skip to content

Hide Navigation Hide TOC

Potential Remote PowerShell Session Initiated (c539afac-c12a-46ed-b1bd-5a5567c9f045)

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

Cluster A Galaxy A Cluster B Galaxy B Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Potential Remote PowerShell Session Initiated (c539afac-c12a-46ed-b1bd-5a5567c9f045) Sigma-Rules 1
Potential Remote PowerShell Session Initiated (c539afac-c12a-46ed-b1bd-5a5567c9f045) Sigma-Rules Windows Remote Management - T1021.006 (60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65) Attack Pattern 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2
Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba) Attack Pattern Windows Remote Management - T1021.006 (60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65) Attack Pattern 2