Incoming Execution via WinRM Remote Shell

 1[metadata]
 2creation_date = "2020/11/24"
 3integration = ["endpoint", "windows"]
 4maturity = "production"
 5updated_date = "2024/10/15"
 6min_stack_version = "8.14.0"
 7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
 8
 9[rule]
10author = ["Elastic"]
11description = """
12Identifies remote execution via Windows Remote Management (WinRM) remote shell on a target host. This could be an
13indication of lateral movement.
14"""
15false_positives = [
16    """
17    WinRM is a dual-use protocol that can be used for benign or malicious activity. It's important to baseline your
18    environment to determine the amount of noise to expect from this tool.
19    """,
20]
21from = "now-9m"
22index = [
23    "winlogbeat-*",
24    "logs-endpoint.events.process-*",
25    "logs-endpoint.events.network-*",
26    "logs-windows.sysmon_operational-*",
27]
28language = "eql"
29license = "Elastic License v2"
30name = "Incoming Execution via WinRM Remote Shell"
31risk_score = 47
32rule_id = "1cd01db9-be24-4bef-8e7c-e923f0ff78ab"
33severity = "medium"
34tags = [
35    "Domain: Endpoint",
36    "OS: Windows",
37    "Use Case: Threat Detection",
38    "Tactic: Lateral Movement",
39    "Data Source: Elastic Defend",
40    "Data Source: Sysmon",
41]
42type = "eql"
43
44query = '''
45sequence by host.id with maxspan=30s
46   [network where host.os.type == "windows" and process.pid == 4 and network.direction : ("incoming", "ingress") and
47    destination.port in (5985, 5986) and network.protocol == "http" and source.ip != "127.0.0.1" and source.ip != "::1"]
48   [process where host.os.type == "windows" and 
49    event.type == "start" and process.parent.name : "winrshost.exe" and not process.executable : "?:\\Windows\\System32\\conhost.exe"]
50'''
51
52
53[[rule.threat]]
54framework = "MITRE ATT&CK"
55[[rule.threat.technique]]
56id = "T1021"
57name = "Remote Services"
58reference = "https://attack.mitre.org/techniques/T1021/"
59[[rule.threat.technique.subtechnique]]
60id = "T1021.006"
61name = "Windows Remote Management"
62reference = "https://attack.mitre.org/techniques/T1021/006/"
63
64
65
66[rule.threat.tactic]
67id = "TA0008"
68name = "Lateral Movement"
69reference = "https://attack.mitre.org/tactics/TA0008/"