Evil-WinRM remote shell used for bird-agent backdoor delivery

Arnold Chan@slaz

•updated Sep 4, 2026•0•0•3

Detects Evil-WinRM / WinRM-fs usage or wsmprovhost.exe-spawned PowerShell tied specifically to bird-agent backdoor artifacts (cplsupport, wtass, config.toml) or encoded/download-cradle command patterns, rather than any WinRM session, reducing noise from routine remote administration.