Management & monitoringTCP 5985, 5986 Encrypted
Port 5985, 5986: WinRM
Windows Remote Management
PowerShell remoting. 5985 is HTTP (the payload is still encrypted after authentication in domains); 5986 is HTTPS.
How attackers abuse it
- Lateral movement with stolen credentials (evil-winrm style tools).
How to defend it
- Allow only from admin jump hosts; use 5986 with certificates.
- Just Enough Administration (JEA) and logging.
Exam tip
PowerShell remoting runs over WinRM, so blocking 5985/5986 between workstations limits lateral movement.