Remote PowerShell Sessions Network Connections with WinRM

Luís Marques@remotecodeexecution

•updated Jul 6, 2026•3•0•8

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986