Situational AwarenessCAR-2014-11-006

Windows Remote Management (WinRM)

Hypothesis and description

When a Windows Remote Management connection is opened, the client sends HTTP requests to port 5985 for HTTP or 5986 for HTTPS on the target host. Each HTTP(S) request to the URI "/wsman" is called, and other information is set in the headers. Depending on the operation, the HTTP method may vary (i.e., GET, POST, etc.). This analytic would detect Remote PowerShell, as well as other communications that rely on WinRM. Additionally, it outputs the executable on the client host, the connection information, and the hostname of the target host.

Platforms: Windows
Domain: Host, Network
Subtypes: Network, Netflow
Submitted: 2014-11-19
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1021 Remote ServicesT1021.006	Lateral Movement	Moderate

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1021Remote Services
.006 Windows Remote Management

D3FEND techniques MITRE maps to this analytic

D3-ANAA Administrative Network Activity Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

flow/start/dest_port

Pseudocode and implementations

Pseudocode

Look for network connections to port 5985 and 5986. To really decipher what is going on, these outputs should be fed into something that can do packet analysis.

flow = search Flow:Start
winrm = filter flow where (dest_port == 5985)
winrm_s = filter flow where (dest_port == 5986)
output winrm, winrm_s

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

View CAR-2014-11-006 on car.mitre.org