Monitor use of WinRM within an environment by tracking service execution. Monitor for newly executed processes that may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM), as well as service processes such as wmiprvse.exe on destination hosts.

Monitor for newly constructed network connections using Windows Remote Management (WinRM), such as remote WMI connection attempts (typically over port 5985 when using HTTP and 5986 for HTTPS).

The adversary may then perform actions as the logged-on user. Monitor for user accounts logging into the system via Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). Monitor executed commands and arguments that may invoke a WinRM script to correlate it with other related events. If the service is necessary, lock down critical enclaves with separate WinRM accounts and permissions. If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices. Wizard Spider has used Window Remote Management to move laterally through a victim network. Threat Group-3390 has used WinRM to enable remote execution. ĭuring the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts. SILENTTRINITY tracks TrustedHosts and can move laterally to these targets via WinRM.

Ĭobalt Strike can use WinRM to execute a payload on a remote host.

Ĭhimera has used WinRM for lateral movement. Brute Ratel C4 can use WinRM for pivoting.

Windows firewall remote management