Cross-source coverage
T1021.006 / ATT&CK
Remote Services: Windows Remote Management
27 rules across 6 sources.
From MITRE ATT&CK 19.2
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.
- Tactics
- Lateral Movement
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:SysmonWinEventLog:WinRMNSM:Connections
How MITRE says to detect it DET0477
Behavioral Detection of WinRM-Based Remote Access
Windows Analytic 1313
Adversaries using WinRM to remotely execute commands, launch child processes, or access WMI. The detection chain includes service use, network activity, remote session logon, and process creation within a short temporal window.
WinEventLog:SecurityEventCode=4624, 4648WinEventLog:SysmonEventCode=1WinEventLog:WinRMEventCode=6NSM:ConnectionsInbound on ports 5985/5986
SigmaHQ/sigma
11 rules| Detection | Severity | Format |
|---|---|---|
| OMIGOD HTTP No Authentication RCE - CVE-2021-38647 | High | Sigma |
| Potential Remote PowerShell Session Initiated | High | Sigma |
| Remote LSASS Process Access Through Windows Remote Management | High | Sigma |
| Remote PowerShell Session (PS Module) | High | Sigma |
| Winrs Local Command Execution | High | Sigma |
| Enable Windows Remote Management | Medium | Sigma |
| Execute Invoke-command on Remote Host | Medium | Sigma |
| HackTool - WinRM Access Via Evil-WinRM | Medium | Sigma |
| Potential Lateral Movement via Windows Remote Shell | Medium | Sigma |
| Remote PowerShell Session Host Process (WinRM) | Medium | Sigma |
+ 1 more from SigmaHQ/sigma → showing the 10 highest-severity
splunk/security_content
9 rules| Detection | Severity | Format |
|---|---|---|
| Interactive Session on Remote Endpoint with PowerShell | Undefined | SPL |
| Possible Lateral Movement PowerShell Spawn | Undefined | SPL |
| Powershell Remote Services Add TrustedHost | Undefined | SPL |
| Remote Process Instantiation via WinRM and PowerShell | Undefined | SPL |
| Remote Process Instantiation via WinRM and PowerShell Script Block | Undefined | SPL |
| Remote Process Instantiation via WinRM and Winrs | Undefined | SPL |
| Windows Remote Host Computer Management Access | Undefined | SPL |
| Windows Remote Management Execute Shell | Undefined | SPL |
| Wsmprovhost LOLBAS Execution Process Spawn | Undefined | SPL |
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Incoming Execution via PowerShell Remoting | Medium | Elastic TOML |
| Incoming Execution via WinRM Remote Shell | Medium | Elastic TOML |
| Potential PowerShell HackTool Script by Function Names | Medium | Elastic TOML |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| Powershell script used "Invoke-command" cmdlet to execute code on remote computer | Critical | Wazuh XML |
| Detected WinRM activity from to · win.eventdata.destinationPort = 5985 | Low | Wazuh XML |
chronicle/detection-rules
1 rule| Detection | Severity | Format |
|---|---|---|
| potential_remote_powershell_session_initiated | High | YARA-L |
socfortress/Wazuh-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Powershell script: TrustedHosts modification detected (DarkGate) | High | Wazuh XML |