Merge PR SigmaHQ#4659 from @nasbench - Reduce `Remote PowerShell Sess…

…ion (PS Classic)` Level update: Remote PowerShell Session (PS Classic) - Reduce level to low
doker78 · Jan 3, 2024 · 36290c5 · 36290c5
1 parent 9988614
commit 36290c5
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml b/rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml
@@ -9,7 +9,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019/08/10
-modified: 2023/10/27
+modified: 2024/01/03
 tags:
     - attack.execution
     - attack.t1059.001
@@ -26,4 +26,5 @@ detection:
     condition: selection
 falsepositives:
     - Legitimate use remote PowerShell sessions
-level: high
+# Note: Increase the level to "medium" in environments that do not leverage PowerShell remoting
+level: low