Windows Remote Management Execute Shell

This analytic detects selected processes spawned directly by Windows Remote Management Host processes winrshost.exe and wsmprovhost.exe. The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration. Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.