Suspicious WSMAN Provider Image Loads

SigmaHQ Detections@sigmaHQ

•updated Oct 17, 2025•1•0•22

Detects the loading of WSMAN provider DLLs by processes other than the expected svchost.exe, or by svchost.exe with an unexpected original filename. This can indicate local or remote execution using Windows Remote Management (WinRM) or Windows Management Instrumentation (WMI) for lateral movement or execution, potentially by an attacker.