Potential Lateral Movement via Windows Remote Shell

Status: experimental
Severity: medium
Log source: category process_creation, product windows
Author: Liran Ravich
Source: github.com/SigmaHQ/sigma

Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.

Known false positives

Legitimate use of WinRM within the organization

MITRE ATT&CK coverage

Tactic	Techniques
Lateral Movement	`T1021.006` Remote Services: Windows Remote Management

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential Lateral Movement via Windows Remote Shell
id: 79df3f68-dccb-48e9-9171-b75cbc37c51d
status: experimental
description: |
    Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.
references:
    - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
    - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
author: Liran Ravich
date: 2025-10-22
tags:
    - attack.lateral-movement
    - attack.t1021.006
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Note: Example of command to simulate (winrm needs to be enabled): "c:\Windows\System32\winrs.exe" powershell
        ParentImage|endswith: '\winrshost.exe'
    filter_main_conhost:
        Image: 'C:\Windows\System32\conhost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate use of WinRM within the organization
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    ParentImage|endswith: '\winrshost.exe'

Stage 2: `not filter_main_conhost`

filter_main_conhost:
    Image: 'C:\Windows\System32\conhost.exe'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	eq	`C:\Windows\System32\conhost.exe`	`excludes:Image` `field:"Image" value:"C:\Windows\System32\conhost.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ParentImage`	ends_with	`\winrshost.exe`	`field:"ParentImage" kind:ends_with value:"\winrshost.exe"`