<jupyter_start><jupyter_text>PowerShell Remote Session  Metadata |     Metadata      |  Value  ||:------------------|:---|| collaborators     | ['@Cyb3rWard0g', '@Cyb3rPandaH'] || creation date     | 2019/05/11 || modification date | 2020/09/20 || playbook related  | ['WIN-190410151110'] |  HypothesisAdversaries might be leveraging remote powershell sessions to execute code on remote systems throughout my environment  Technical ContextNone  Offensive TradecraftAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.In addition, it can be used to execute code remotely via Windows Remote Management (WinRM) services.Therefore, it is important to understand the basic artifacts left when PowerShell is used to execute code remotely via a remote powershell session.  Security Datasets | Metadata  |    Value  ||:----------|:----------|| docs      | https://securitydatasets.com/notebooks/atomic/windows/execution/SDWIN-190518211456.html        || link      | [https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/lateral_movement/host/empire_psremoting_stager.zip](https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/lateral_movement/host/empire_psremoting_stager.zip)  |  Analytics  Initialize Analytics Engine<jupyter_code>from openhunt.mordorutils import *
spark = get_spark()<jupyter_output><empty_output><jupyter_text>Download & Process Security Dataset<jupyter_code>sd_file = "https://raw.githubusercontent.com/OTRF/Security-Datasets/master/datasets/atomic/windows/lateral_movement/host/empire_psremoting_stager.zip"
registerMordorSQLTable(spark, sd_file, "sdTable")<jupyter_output><empty_output><jupyter_text>Analytic IProcess wsmprovhost hosts the active remote session on the target. Therefore, it is important to monitor for any the initialization of the PowerShell host wsmprovhost | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Powershell | Windows PowerShell | Application host started | 400 || Powershell | Microsoft-Windows-PowerShell/Operational | User started Application host | 4103 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, Channel
FROM sdTable
WHERE (Channel = "Microsoft-Windows-PowerShell/Operational" OR Channel = "Windows PowerShell")
    AND (EventID = 400 OR EventID = 4103)
    AND Message LIKE "%HostApplication%wsmprovhost%"
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IIMonitor for any incoming network connection where the destination port is either 5985 or 5986. That will be hosted most likely by the System process. Layer ID:44 | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Security-Auditing | Process connected to Port | 5156 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, Application, SourceAddress, DestAddress, LayerName, LayerRTID
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 5156
    AND (DestPort = 5985 OR DestPort = 5986)
    AND LayerRTID = 44
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IIIProcess wsmprovhost hosts the active remote session on the target. Therefore, from a process creation perspective, it is to document any instances of wsmprovhost being spawned and spawning other processes | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Security-Auditing | Process created Process | 4688 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, ParentProcessName, NewProcessName
FROM sdTable
WHERE LOWER(Channel) = "security"
    AND EventID = 4688
    AND (ParentProcessName LIKE "%wsmprovhost.exe" OR NewProcessName LIKE "%wsmprovhost.exe")
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic IVProcess wsmprovhost hosts the active remote session on the target. Therefore, from a process creation perspective, it is to document any instances of wsmprovhost being spawned and spawning other processes | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Sysmon/Operational | Process created Process | 1 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, ParentImage, Image
FROM sdTable
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 1
    AND (ParentImage LIKE "%wsmprovhost.exe" OR Image LIKE "%wsmprovhost.exe")
'''
)
df.show(10,False)<jupyter_output><empty_output><jupyter_text>Analytic VMonitor for outbound network connection where the destination port is either 5985 or 5986 and the use is not NT AUTHORITY\NETWORK SERVICE | Data source | Event Provider | Relationship | Event ||:------------|:---------------|--------------|-------|| Process | Microsoft-Windows-Sysmon/Operational | User connected to Port | 3 |<jupyter_code>df = spark.sql(
'''
SELECT `@timestamp`, Hostname, User, Initiated, Image, SourceIp, DestinationIp
FROM sdTable
WHERE Channel = "Microsoft-Windows-Sysmon/Operational"
    AND EventID = 3
    AND (DestinationPort = 5985 OR DestinationPort = 5986)
    AND NOT User = "NT AUTHORITY\\\\NETWORK SERVICE"
'''
)
df.show(10,False)<jupyter_output><empty_output>
{'fraction_non_alphanumeric': 0.14428228339183446, 'fraction_numerical': 0.02272307408091631, 'mean_word_length': 4.170964660936008, 'pattern_counts': {'":': 0, '<': 29, '<?xml version=': 0, '>': 29, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '7', 'dir': 'jupyter-structured-clean-dedup', 'id': '276502', 'license': 'MIT', 'n_tokens_mistral': 1629, 'n_tokens_neox': 1482, 'n_words': 452, 'path': 'docs/notebooks/windows/02_execution/WIN-190511223310.ipynb', 'repo_name': 'hitenkoku/ThreatHunter-Playbook', 'size': '5413'}