WinRM-fs/Evil-WinRM file staging of bird-agent config via wsmprovhost
Detects instances where the Windows Remote Management host process (wsmprovhost.exe) is associated with the execution of specific suspicious files (config.toml, cplsupport.exe, or wtass.exe) within a short time window. This activity often indicates post-exploitation behavior or remote execution of secondary tools using WinRM.
Microsoft Sentinel (KQL)
