Service Accounts Performing Remote PS

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


Service Accounts Performing Remote PowerShell. The purpose behind this detection is for finding service accounts that are performing remote powershell sessions. There are two phases to the detection: Identify service accounts, Find remote PS cmdlets being ran by these accounts. To accomplish this, we utilize DeviceLogonEvents and DeviceEvents to find cmdlets ran that meet the criteria. One of the main advantages of this method is that only requires server telemetry, and not the attacking client.

Attribute Value
Type Analytic Rule
Solution Microsoft Defender XDR
ID d29cc957-0ddb-4d00-8d6f-ad1bb345ff9a
Severity High
Status Available
Kind Scheduled
Tactics LateralMovement
Techniques T1210
Required Connectors MicrosoftThreatProtection
Source View on GitHub

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Microsoft Defender XDR