Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

Windows Enable PowerShell Web Access

The following analytic detects the enabling of PowerShell Web Access via PowerShell commands. It leverages PowerShell script block logging (EventCode 4104) to identify the execution of the `Install-WindowsFeature` cmdlet with the `WindowsPowerShellWebAccess` parameter. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks.

ATT&CK coverage

Outside the enterprise matrix

T1059.001PowerShell 362 detections cover this technique

Detection requirements

Log source category: powershell_script_block_logging_4104

What the source says

What fires this without an attack behind it

It is possible that legitimate scripts or network administrators may enable PowerShell Web Access. Monitor and escalate as needed.

References

Tagged by the source as

CISA AA24-241AMalicious PowerShellEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.