Incoming Execution via WinRM Remote Shell

 1[metadata]
 2creation_date = "2020/11/24"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 6min_stack_version = "8.3.0"
 7updated_date = "2023/06/22"
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an
13indication of lateral movement.
14"""
15false_positives = [
16    """
17    WinRM is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your
18    environment to determine the amount of noise to expect from this tool.
19    """,
20]
21from = "now-9m"
22index = ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.*"]
23language = "eql"
24license = "Elastic License v2"
25name = "Incoming Execution via WinRM Remote Shell"
26risk_score = 47
27rule_id = "1cd01db9-be24-4bef-8e7c-e923f0ff78ab"
28severity = "medium"
29tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Lateral Movement", "Data Source: Elastic Defend"]
30type = "eql"
31
32query = '''
33sequence by host.id with maxspan=30s
34   [network where host.os.type == "windows" and process.pid == 4 and network.direction : ("incoming", "ingress") and
35    destination.port in (5985, 5986) and network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
36   [process where host.os.type == "windows" and 
37    event.type == "start" and process.parent.name : "winrshost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
38'''
39
40
41[[rule.threat]]
42framework = "MITRE ATT&CK"
43[[rule.threat.technique]]
44id = "T1021"
45name = "Remote Services"
46reference = "https://attack.mitre.org/techniques/T1021/"
47[[rule.threat.technique.subtechnique]]
48id = "T1021.006"
49name = "Windows Remote Management"
50reference = "https://attack.mitre.org/techniques/T1021/006/"
51
52
53[rule.threat.tactic]
54id = "TA0008"
55name = "Lateral Movement"
56reference = "https://attack.mitre.org/tactics/TA0008/"