New-PSSession -ComputerName dc-mantvydas -Credential (Get-Credential) Id Name ComputerName ComputerType State ConfigurationName Availability----------------------------------------------------------------1 Session1 dc-mantvydas RemoteMachine Opened Microsoft.PowerShell AvailablePS C:\Users\mantvydas> Enter-PSSession 1[dc-mantvydas]: PS C:\Users\spotless\Documents>calc.exe
Observations
Note the process ancestry:
On the host that initiated the connection, a 4648 logon attempt is logged, showing what process initiated it, the hostname where it connected to and which account was used:
The below graphic shows that the logon events 4648 annd 4624 are being logged on both the system that initiated the connection (pc-mantvydas - 4648) and the system that it logged on to (dc-mantvydas - 4624):
Additionally, %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-WinRM%4Operational.evtx on the host that initiated connection to the remote host, logs some interesting data for a task WSMan Session initialize :
...same as above just in the actual screenshot:
Since we entered into a PS Shell on the remote system (Enter-PSSession) , there is another interesting log showing the establishment of a remote shell - note that the ShellID corresponds to the earlier observed Correlation ActivityID:
Additional Useful Commands
Jules Adriaens reached out to me and suggested to add the following useful commands, so here they are:
