WinRM Lateral Movement via winrs.exe, PSSession, or wsmprovhost.exe

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects potential lateral movement activity involving Windows Remote Management (WinRM). The rule monitors for common WinRM-related tools (winrs.exe), PowerShell WinRM cmdlets (e.g., Invoke-Command) targeting non-local systems, and the spawning of suspicious processes by the WinRM host process (wsmprovhost.exe).