medium Sigma Windows experimental

Remote Execution via WinRM Host Process

wsmprovhost.exe spawning a child means a remote PowerShell session ran something here. Expected from jump hosts, suspicious from anywhere else.

Rule source

winrm-remote-execution.yml

title: Remote Execution via WinRM Host Process
id: 2d58e0fc-4a7b-4c91-93ea-6f0b81d7c542
status: experimental
description: >
  wsmprovhost.exe spawning a child process means a remote PowerShell session
  executed something on this host. Expected from admin tooling and jump hosts,
  suspicious from anywhere else - scope this rule with an allowlist of sources.
references:
  - https://attack.mitre.org/techniques/T1021/006/
author: DetectionOps
date: 2026/09/11
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\wsmprovhost.exe'
  filter_noise:
    Image|endswith:
      - '\conhost.exe'
      - '\WerFault.exe'
  condition: selection and not filter_noise
fields:
  - Image
  - CommandLine
  - User
  - ComputerName
falsepositives:
  - Legitimate remote administration - allowlist by source host, not by user
  - Configuration management that uses PowerShell remoting as a transport
level: medium
tags:
  - attack.lateral_movement
  - attack.t1021.006

Required telemetry

Sysmon - Event ID 1 (process creation)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Legitimate remote administration - allowlist by source host, not by account
Configuration management using PowerShell remoting as its transport

Validation

Invoke-Command from an unapproved source in the lab; still tuning the allowlist

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.