Skip to main content
Tier One
Medium

PowerShell remoting used by IT during approved patching

A-1050

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
EDR
Detection rule
EDR-PS-REMOTING-015
Affected user
a.brennan
Affected host
SRV-FILE-03
Source IP
—
First seen
2026-07-24T14:44:00Z

Why this fired, in plain English

PowerShell was used to run commands on another computer over the network.

Suggested playbook

Suspicious PowerShell execution

  1. 1. Decode any base64 in the command line and read the actual script.
  2. 2. Check the parent process. ccmexec.exe or services.exe is usually management; WINWORD.EXE is not.
  3. 3. Check whether the script file is signed, and by whom.
  4. 4. Look for outbound connections made by powershell.exe and whether they were blocked.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. ts=2026-07-24T14:43:20Z host=SRV-FILE-03 EventID=4688 process_name="wsmprovhost.exe" parent_process="svchost.exe" user="a.brennan" cmdline="Install-WindowsUpdate -AcceptAll -IgnoreReboot"

    wsmprovhost.exe is the normal host process for PowerShell remoting sessions.

  2. Guided hint: this line matters

    ts=2026-07-24T14:43:20Z host=SRV-FILE-03 EventID=4624 account="a.brennan" src_ip=10.20.9.15 logon_type=3 auth_package="Kerberos" mfa=satisfied

    The connection came from the internal admin jump host using Kerberos.

  3. Guided hint: this line matters

    ts=2026-07-24T14:40:00Z src="itsm" event=change_window ticket="CHG-4478" summary="July patch cycle, file servers" approver="s.bell" window="2026-07-24T14:30Z/2026-07-24T16:00Z" assignee="a.brennan"

Related events

The order things happened in.

  1. 14:40Z

    Patch change window opens

  2. 14:43Z

    Remote session from admin jump host

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 4 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.