Interactive Session on Remote Endpoint with PowerShell

Try in Splunk Security Cloud

Description

The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify the usage of the Enter-PSSession. This commandlet can be used to open an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams and adversaries alike may abuse WinRM and Enter-PSSession for lateral movement and remote code execution.

• Type: TTP

• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud

• Last Updated: 2022-03-22
• Author: Mauricio Velazco, Splunk
• ID: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1021	Remote Services	Lateral Movement

T1021.006

Windows Remote Management

Lateral Movement

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 10

CVE

Search

`powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*") 
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `interactive_session_on_remote_endpoint_with_powershell_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime
• powershell

interactive_session_on_remote_endpoint_with_powershell_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• _time
• EventCode
• Message
• ComputerName
• User

How To Implement

To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.

Known False Positives

Administrators may leverage WinRM and Enter-PSSession for administrative and troubleshooting tasks. This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible.

Associated Analytic Story

• Active Directory Lateral Movement

RBA

Risk Score	Impact	Confidence	Message
45.0	90	50	An interactive session was opened on a remote endpoint from $ComputerName

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://attack.mitre.org/techniques/T1021/006/
• https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 3