Local Command Proxy Execution Via Winrs.EXE

Rule Info

Name
Local Command Proxy Execution Via Winrs.EXE
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of local command via "winrs.exe" using the WinRM service. An attacker can enable the WinRM service locally and start to proxy commands on the system through "winrshost.exe". This form of execution can be used as a living of the land binary in order to potentially bypass application whitelisting.
Reference
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
Date
2024-05-03 00:00:00
Modified
None
Id
289d25bb-0f61-4c5b-a7fe-73b81dbfa5cb
Tags
attack.execution
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022