PowerShell Remoting Abuse

Overview

PowerShell Remoting Abuse is a technique where adversaries leverage legitimate Windows PowerShell remote management capabilities to execute commands or scripts on remote systems. This technique facilitates various stages of the attack lifecycle, including lateral movement, persistence, and command execution, by exploiting trusted administrative channels to evade detection and maintain control.

Attack Objective

• Gain remote execution capabilities and control over target systems
• Supports multiple stages: Execution, Persistence, Privilege Escalation, Lateral Movement, Defense Evasion, and Command & Control
• Advances attacker position by enabling stealthy, remote administration and movement within a network without deploying additional malware

How the Technique Works

PowerShell Remoting Abuse involves using built-in Windows features such as Windows Remote Management (WinRM) and PowerShell sessions to run commands on remote hosts. Adversaries authenticate using valid credentials or stolen tokens to establish remote PowerShell sessions, allowing them to execute scripts or commands as if they were locally present. This method leverages native administrative tools, reducing the need for external binaries and minimizing detection risk.

Common Methods & Variations

• Utilization of PowerShell cmdlets like Invoke-Command, Enter-PSSession, and New-PSSession for remote execution
• Abuse of WinRM protocol over HTTP/HTTPS for communication with remote endpoints
• On-premises environments commonly targeted, with cloud environments leveraging similar PowerShell remoting capabilities within virtual machines or hybrid setups
• Predominantly living-off-the-land techniques using native PowerShell and Windows components rather than custom malware

Indicators of Compromise (IOCs)

• Event logs showing unusual PowerShell remoting activity, such as creation of remote sessions or execution of remote commands
• Authentication logs indicating remote logins via WinRM or PowerShell remoting protocols
• Network traffic on ports 5985 (HTTP) and 5986 (HTTPS) associated with WinRM
• Presence of PowerShell scripts or commands executed remotely in process creation logs

Detection Strategies

• Monitoring Windows Event Logs, including PowerShell Operational logs and WinRM logs
• Behavioral detection focusing on anomalous remote PowerShell session creation and command execution patterns
• Correlation of authentication events with remote PowerShell activity to identify suspicious lateral movement or privilege escalation attempts

Mitigation & Prevention

• Restrict and monitor use of PowerShell remoting through group policies and network segmentation
• Enforce least privilege principles and use Just Enough Administration (JEA) to limit remoting capabilities
• Implement multi-factor authentication for administrative accounts and restrict WinRM access to authorized hosts
• Enable PowerShell logging and transcription to maintain audit trails

Response Considerations

• Immediately disable compromised remote sessions and revoke associated credentials
• Conduct thorough investigation of PowerShell remoting logs and authentication events to determine scope
• Review and harden remoting configurations, update credentials, and apply principle of least privilege post-incident

Related Techniques

• Credential Dumping to obtain credentials used for remoting
• Remote Services abuse such as Windows Management Instrumentation (WMI) or Remote Desktop Protocol (RDP)
• Living-off-the-land binaries and scripts (LOLBAS) for stealthy execution
• Command and Control channels leveraging native protocols

Mapping & References

• MITRE ATT&CK Tactic(s): Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Lateral Movement, Command and Control
• MITRE ATT&CK Technique: T1028 – Windows Remote Management
• Public advisories and research on PowerShell abuse and detection best practices from cybersecurity vendors and incident response teams