Incoming Execution via WinRM Remote Shell

 1[metadata]
 2creation_date = "2020/11/24"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/05/21"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an
11indication of lateral movement.
12"""
13false_positives = [
14    """
15    WinRM is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your
16    environment to determine the amount of noise to expect from this tool.
17    """,
18]
19from = "now-9m"
20index = [
21    "winlogbeat-*",
22    "logs-endpoint.events.process-*",
23    "logs-endpoint.events.network-*",
24    "logs-windows.sysmon_operational-*",
25]
26language = "eql"
27license = "Elastic License v2"
28name = "Incoming Execution via WinRM Remote Shell"
29risk_score = 47
30rule_id = "1cd01db9-be24-4bef-8e7c-e923f0ff78ab"
31severity = "medium"
32tags = [
33    "Domain: Endpoint",
34    "OS: Windows",
35    "Use Case: Threat Detection",
36    "Tactic: Lateral Movement",
37    "Data Source: Elastic Defend",
38    "Data Source: Sysmon",
39]
40type = "eql"
41
42query = '''
43sequence by host.id with maxspan=30s
44   [network where host.os.type == "windows" and process.pid == 4 and network.direction : ("incoming", "ingress") and
45    destination.port in (5985, 5986) and network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
46   [process where host.os.type == "windows" and 
47    event.type == "start" and process.parent.name : "winrshost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
48'''
49
50
51[[rule.threat]]
52framework = "MITRE ATT&CK"
53[[rule.threat.technique]]
54id = "T1021"
55name = "Remote Services"
56reference = "https://attack.mitre.org/techniques/T1021/"
57[[rule.threat.technique.subtechnique]]
58id = "T1021.006"
59name = "Windows Remote Management"
60reference = "https://attack.mitre.org/techniques/T1021/006/"
61
62
63
64[rule.threat.tactic]
65id = "TA0008"
66name = "Lateral Movement"
67reference = "https://attack.mitre.org/tactics/TA0008/"