WinRM Lateral Movement - Remote PowerShell or WMI SOAP Action on 5985/5986

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.