Rules Contributing to PowerShell Remote Access Alert Type

The following rules are used to identify a Windows host executed a PowerShell script interacting with a remote host. Any one or more of these will trigger the PowerShell Remote Access Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

PowerShell Remote Access

A Windows host executed a PowerShell script interacting with a remote host. Investigate the script and the remote host to determine whether the script is malicious. If so, consider quarantining the host.

More details

Rule ID

powershell_cnc_2200

Query

{'selection1': {'DetectionFlag': 2200}, 'selection2': [{'RemoteIP|re': '^169\\.254\\.169\\.254$'}, {'RemoteIP|re': '\\.0$'}], 'condition': 'selection1 and not selection2'}

Detection Flag

Note: detection_flag is a Stellar enriched field.

2200: PowerShell script embedded with remote IP

Log Source

Stellar Cyber Windows Server Sensor configured.

Rule Source

Developed internally by Stellar Cyber

Tactics, Techniques, and Procedures

TA0002, T1059

References

N/A

Severity

Suppression Logic Based On

computer_name
remote_ip
stellar.rule_id

Additional Information

Maturity	Creation Date	Risk Level	False Positives
production	2021/03/30	critical	N/A

PowerShell Remote Access (High Fidelity)