Query: detect Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. in logs
Matching passage: Sigma rule: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.. Logsource: windows / image_load. Rule: title: Suspicious WSMAN Provider Image Loads id: ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94 status: test description: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. references: - https://twitter.com/chadtilbury/status/1275851297770610688 - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/ - https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture - https://github.com/bohops/WSMan-WinRM author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-24 modified: 2026-07-28 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: request_client: - ImageLoaded|endswith: - \WsmSvc.dll - \WsmAuto.dll - \Microsoft.WSMan.Management.ni.dll - OriginalFileName: - WsmSvc.dll - WSMANAUTOMATION.DLL - Microsoft.WSMan.Management.dll respond_server: Image|endswith: \svchost.exe OriginalFileName: WsmWmiPl.dll filter_general: Image: - C:\Program Files (x86)\PowerShell\6\pwsh.exe - C:\Program Files (x86)\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\6\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\services.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe filter_svchost: CommandLine|contains: - svchost.exe -k netsvcs -p -s BITS - svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc - svchost.exe -k NetworkService -p -s Wecsvc - svchost.exe -k netsvcs filter_mscorsvw: Image|startswith: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \mscorsvw.exe filter_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_svr_2019: Image: - C:\Windows\System32\Configure-SMRemoting.exe - C:\Windows\System32\ServerManager.exe filter_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ filter_citrix: Image|startswith: C:\Program Files\Citrix\ filter_upgrade: Image|startswith: C:\$WINDOWS.~BT\Sources\ filter_mmc: Image|endswith: \mmc.exe svchost: Image|endswith: \svchost.exe commandline_null: CommandLine: null condition: ( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null ) f
Near-miss passage: Sigma rule: Detects the creation of an administrator account on a Fortinet FortiGate Firewall.. Logsource: fortigate / event. Rule: title: FortiGate - New Administrator Account Created id: cd0a4943-0edd-42cf-b50c-06f77a10d4c1 status: experimental description: Detects the creation of an administrator account on a Fortinet FortiGate Firewall. references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.t1136.001 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: system.admin condition: selection falsepositives: - An administrator account can be created for legitimate purposes. Investigate the account details to determine if it is authorized. level: medium