Query: Sigma rule for Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched
Matching passage: Sigma rule: Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched. Logsource: windows / process_creation. Rule: title: Winrs Local Command Execution id: bcfece3d-56fe-4545-9931-3b8e92927db1 status: experimental description: 'Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement. ' references: - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs author: Liran Ravich, Nasreddine Bencherchali date: 2025-10-22 tags: - attack.lateral-movement - attack.stealth - attack.t1021.006 - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winrs.exe - OriginalFileName: winrs.exe selection_local_ip: CommandLine|contains|windash: - /r:localhost - /r:127.0.0.1 - /r:[::1] - /remote:localhost - /remote:127.0.0.1 - /remote:[::1] filter_main_remote: CommandLine|contains|windash: - '/r:' - '/remote:' condition: all of selection_* or (selection_img and not 1 of filter_main_*) falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects potentially suspicious processes being spawned by a web server process which could be the result of a successful. Logsource: windows / process_creation. Rule: title: Suspicious Process By Web Server Process id: 8202070f-edeb-4d31-a010-a26c72ac5600 status: test description: 'Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation ' references: - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2024-11-26 tags: - attack.persistence - attack.initial-access - attack.t1505.003 - attack.t1190 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \php.exe - \tomcat.exe - \UMWorkerProcess.exe - \w3wp.exe - \ws_TomcatService.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: - CATALINA_HOME - catalina.home - catalina.jar selection_anomaly_children: Image|endswith: - \arp.exe - \at.exe - \bash.exe - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \dsget.exe - \hostname.exe - \nbtstat.exe - \net.exe - \net1.exe - \netdom.exe - \netsh.exe - \nltest.exe - \ntdsutil.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \qprocess.exe - \query.exe - \qwinsta.exe - \reg.exe - \rundll32.exe - \sc.exe - \sh.exe - \wmic.exe - \wscript.exe - \wusa.exe filter_main_fp_1: ParentImage|endswith: \java.exe CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt filter_main_fp_2: ParentImage|endswith: \java.exe CommandLine|contains|all: - sc query - ADManager Plus condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_* falsepositives: - Particular web applications may spawn a shell process legitimately level: high