WinRM Lateral Movement via wsmprovhost.exe Spawning Child Processes

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects the spawning of common command-line shells (cmd.exe, powershell.exe, net.exe) by the Windows Remote Management (WinRM) process, wsmprovhost.exe. This activity is indicative of lateral movement or remote command execution via WinRM.