Suspicious Processes Spawned by WinRM

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•28

Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.