Windows Remote Management

Windows Remote Management (WinRM) is Microsoft's built-in remote-command-execution protocol, the same mechanism behind PowerShell Remoting. It lets an authenticated user run commands on a remote machine over the network, listening by default on ports 5985 (HTTP) and 5986 (HTTPS).

Like admin shares, this requires no exploit. Anyone with valid credentials for an account permitted to use WinRM on the target can run commands remotely. It's a completely standard administrative capability.

Once an attacker has credentials for an account with WinRM access to other hosts, it's a fast, built-in way to run commands or fully interactive PowerShell sessions on remote machines, with no additional tooling to drop or detect, since PowerShell Remoting is present on essentially every modern Windows install by default.

Frameworks like Empire and toolkits like SharpSploit have purpose-built modules specifically for abusing WinRM this way, but an attacker doesn't strictly need them. The built-in Enter-PSSession and Invoke-Command cmdlets are enough.

Data source: process-attributed network telemetry for 5985/5986 (Sysmon Event ID 3 is partial), sensor WS-Management HTTP requests, and the target's session-host process spawn

{
  "host": {
    "name": "APP01"
  },
  "event": {
    "action": "connection_accepted",
    "category": "network"
  },
  "source": {
    "ip": "10.1.10.30"
  },
  "destination": {
    "ip": "10.1.10.13",
    "port": 5985
  }
}

Prebuilt Elastic rule: Incoming Execution via WinRM Remote Shell

WinRM traffic to a host that doesn't normally receive it, or from a source account/host that isn't part of your known administrative fleet, is the core pattern. Because WinRM is a dual-use protocol used constantly for legitimate remote administration, source and destination pairing matters more than the mere presence of traffic on 5985/5986.

Hunting manually: filter network events on destination.port: (5985, 5986), then cross-reference the source host/account against your known list of admin workstations and accounts that are expected to use remoting. Connections outside that set are the ones worth chasing.

WinRM is genuinely dual-use. IT staff, automation tools, and configuration-management systems (many built on PowerShell Remoting under the hood) use it constantly for entirely legitimate purposes.

The distinguishing signal is whether the source-destination-account combination matches an established administrative pattern: a known admin workstation connecting to servers it regularly manages, using an account documented for that purpose, on a normal schedule, is routine. A user workstation initiating WinRM sessions to other user workstations, or any host connecting somewhere it's never connected before, is what warrants investigation. Maintain a list of your organization's legitimate remote-administration sources so deviations are easy to spot.

• MITRE ATT&CK T1021.006: Windows Remote Management
• Elastic Security: Incoming Execution via WinRM Remote Shell

1 scenario in this catalog covers T1021.006. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →