WinRM Lateral Movement - wsmprovhost.exe Spawning Suspicious Child Process

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.