Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
3
2
1
Platforms
3
Products / Services
3
3
2
MITRE Techniques
3
2
2
2
1
CVEs
71
71
64
57
49
The following analytic detects suspicious processes spawned by WinRM (wsmprovhost.exe). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate exploitation attempts of vulnerabilities like CVE-2021-31166, which could lead to system instability or compromise. If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistence, posing a severe threat to the environment.
This analytic detects selected processes spawned directly by Windows Remote Management Host processes winrshost.exe and wsmprovhost.exe.
The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.
Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.
The selected children include shells, scripting hosts, and administrative, discovery, and file-transfer utilities. This target-side process relationship can indicate remote execution, but it can also result from authorized WinRM administration.
Investigate the account, target host, available command line, and surrounding remote-logon activity to determine context.
The analytic detects suspicious processes spawned by WinRM (wsmprovhost.exe). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific child processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate exploitation attempts of vulnerabilities like CVE-2021-31166, which could lead to system instability or compromise. If confirmed malicious, attackers could execute arbitrary commands, escalate privileges, or maintain persistence, posing a severe threat to the environment.