WinRM remote command
A process was launched by a WinRM host process, meaning someone executed a command on this machine remotely over WS-Management.
What it detects
A process was launched by a WinRM host process, meaning someone executed a command on this machine remotely over WS-Management. WinrsHost.exe serves winrs sessions and wsmprovhost.exe serves PowerShell Remoting; when either is the parent of a shell or interpreter, the command came from another host.
WinRM is the intended remote-administration channel on Windows, so this rule reports the FACT of remote execution rather than asserting it is malicious. Its value is in the endpoint's own record: it names the command that ran, which the originating host's logs alone will not tell you.
MITRE ATT&CK mapping
- T1021.006Remote Services: Windows Remote Management· Lateral Movement
False positives and triage
Expected wherever PowerShell Remoting or winrs is the sanctioned administration path — in those estates this fires constantly and should be baselined per source host and per account, or scoped to servers that are not normally administered this way.
To confirm: read the child's command line, which is the actual remote instruction. Discovery commands (whoami, ipconfig, net), encoded PowerShell, or anything writing to disk are worth pursuing. Correlate with the WinRM authentication on the same host to identify the source; a remote command from a workstation rather than a management server is the shape that matters.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 70%. Source: rules/windows/winrm_remote_command.yaml, licensed under the Apache License 2.0.
id: windows.lateral_movement.winrm_remote_command
version: 1.0.0
status: stable
severity: high
confidence: 0.7
platforms: [windows]
mitre_techniques: [T1021.006]
description: |
A process was launched by a WinRM host process, meaning someone executed a command
on this machine remotely over WS-Management. `WinrsHost.exe` serves `winrs`
sessions and `wsmprovhost.exe` serves PowerShell Remoting; when either is the
parent of a shell or interpreter, the command came from another host.
WinRM is the intended remote-administration channel on Windows, so this rule
reports the FACT of remote execution rather than asserting it is malicious. Its
value is in the endpoint's own record: it names the command that ran, which the
originating host's logs alone will not tell you.
match:
event_category: process
parent_process_name_any:
- winrshost.exe
- wsmprovhost.exe
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Expected wherever PowerShell Remoting or `winrs` is the sanctioned administration
path — in those estates this fires constantly and should be baselined per source
host and per account, or scoped to servers that are not normally administered this
way.
To confirm: read the child's command line, which is the actual remote instruction.
Discovery commands (`whoami`, `ipconfig`, `net`), encoded PowerShell, or anything
writing to disk are worth pursuing. Correlate with the WinRM authentication on the
same host to identify the source; a remote command from a workstation rather than
a management server is the shape that matters.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.