Detection rules › Sigma
WinRS usage for remote execution
Detects scenarios where an attacker abuses the WinRS capacities for remote execution.
Known false positives
- Pentest, Administrator activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: WinRS usage for remote execution
description: Detects scenarios where an attacker abuses the WinRS capacities for remote execution.
references:
- https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
- https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/
- https://4sysops.com/archives/powershell-remoting-without-administrator-rights/
- https://www.synacktiv.com/publications/traces-of-windows-remote-command-execution.html
tags:
- attack.lateral_movement
- attack.t1021.006
author: mdecrevoisier
logsource:
product: windows
category: process_creation
detection:
selection: # Full command example: "winrs -r:<target> -u:domain\user -p:<psw> 'whoami /priv'"
NewProcessName|endswith: \winrs.exe
CommandLine|contains:
- '-r:'
- '/r:'
condition: selection
falsepositives:
- Pentest, Administrator activity
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
NewProcessName|endswith: \winrs.exe
CommandLine|contains:
- '-r:'
- '/r:'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\winrs.exe" |