WinRM Lateral Movement via winrs/PSSession - WSMan SOAP on 5985/5986

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects potential lateral movement attempts using Windows Remote Management (WinRM) by monitoring for specific WSMan SOAP protocol headers in HTTP traffic. It specifically looks for POST requests to the WSMan endpoint that contain suspicious keywords like 'winrs', 'MSRPC', or 's:Envelope', which are commonly associated with remote command execution via winrs or PSSession.