detection.wiki

Detection rules › Kusto

Detect Unknown process launched via WinRM

Group by
DeviceId
Author
Robbe Van den Daele
Source
github.com/HybridBrothers/Hunting-Queries-Detection-Rules

When an unknown process is being launched from the WinRM service on a server, this might indicate a malicious actor spreading malware on various servers via the WinRM protocol.

MITRE ATT&CK coverage

TacticTechniques
Lateral Movement

References

Telemetry coverage

PlatformRecord / event type
Microsoft Defender for EndpointDeviceNetworkEvents action InboundConnectionAccepted: Inbound connection accepted
Microsoft Defender for EndpointDeviceProcessEvents action any: Process activity

Rule body

DeviceProcessEvents
| where InitiatingProcessFileName contains "wsmprovhost.exe"
| invoke FileProfile(SHA1)
| where GlobalPrevalence < 1000
| join kind=leftouter (
    DeviceNetworkEvents
    | where ActionType == "InboundConnectionAccepted"
    | where LocalPort in ("5985", "5986")
    | distinct RemoteIP, DeviceId
) on DeviceId
| project-away DeviceId1

Stages and Predicates

Stage 1: source

DeviceProcessEvents

Stage 2: where

| where InitiatingProcessFileName contains "wsmprovhost.exe"

Stage 3: invoke

| invoke FileProfile(SHA1)

Stage 4: where

| where GlobalPrevalence < 1000

Stage 5: join

| join kind=leftouter (
    DeviceNetworkEvents
    | where ActionType == "InboundConnectionAccepted"
    | where LocalPort in ("5985", "5986")
    | distinct RemoteIP, DeviceId
) on DeviceId

Stage 6: project-away

| project-away DeviceId1

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ActionTypeeq
  • InboundConnectionAccepted
field:"ActionType" kind:eq value:"InboundConnectionAccepted"
GlobalPrevalencelt
  • 1000
field:"GlobalPrevalence" kind:lt value:"1000"
InitiatingProcessFileNamecontains
  • wsmprovhost.exe
field:"parent_process_name" kind:contains value:"wsmprovhost.exe"
LocalPortin
  • 5985
  • 5986
field:"SourcePort" kind:in