Suspicious Non-PowerShell WSMAN COM Provider Use

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•16

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application. This could indicate an adversary attempting to use Windows Remote Management (WinRM) for lateral movement or execution without directly invoking PowerShell, potentially to evade detection.