Sigma Rule Update (2024-01-04 20:07:30) (#562)

Co-authored-by: hach1yon <[email protected]>

sigma/builtin/powershell/powershell_classic/posh_pc_remote_powershell_session.yml

@@ -9,7 +9,7 @@ references:
     - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
 author: Roberto Rodriguez @Cyb3rWard0g
 date: 2019/08/10
-modified: 2023/10/27
+modified: 2024/01/03
 tags:
     - attack.execution
     - attack.t1059.001
@@ -29,5 +29,5 @@ detection:
     condition: ps_classic_start and selection
 falsepositives:
     - Legitimate use remote PowerShell sessions
-level: high
+level: low
 ruletype: Sigma