Hacktool Evil-Winrm Tool Detection via Powershell event ID

[cY83rR0H1t]

Description of the Idea of the Rule

Evil-winrm is a tool that interacts with the Windows Remote Management (WinRM) service.
Evil-WinRM attempts to authenticate with the target Windows system using the provided credentials. This includes options like IP, username and password.

Public References / Exampel Event Log

https://medium.com/@princerohit8800/evil-winrm-detection-de2874af7eb0

Title: Hacktool Evil-Winrm Tool
id: b1d34cd1-5c5d-481d-821d-4e17d8b73fa1
status: Experimental
description: Suspicious usage of Evil-Winrm detection using PowerShell event.
author: Rohit Jain
date: 2024/02/25
tags:
    - attack.initial_access
logsource:
    product: windows
    category: ps_module
detection:
    event id: 4103
    selection:
        Payload|Message|contains|all:
            - Invoke-Expression
            - (get-location).path
            - ParameterBinding(Out-Default)
            - value=(\"C:\\Users\\(.{1,})\\Documents\")
            - C:\Windows\system32\wsmprovhost.exe
    condition: selection
falsepositives:
    - N/A
level: Medium