Suspicious Remote Code Execute through Winrm.vbs (via process_creation)

title: Suspicious Remote Code Execute through Winrm.vbs (via process_creation)
id: bf7a1b6c-e4ae-5e22-a0a9-3643ae25965a
status: stable
description: This rule detects an attempt to execute code or create service on remote host via winrm.vbs.
references:
    - https://attack.mitre.org/techniques/T1216/
    - https://twitter.com/bohops/status/994405551751815170
    - https://redcanary.com/blog/lateral-movement-winrm-wmi/
    - https://lolbas-project.github.io/lolbas/Scripts/Winrm/
author: Huntrule Team
date: 2026-06-04
tags:
    - attack.stealth
    - attack.t1216
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cscript.exe'
        - OriginalFileName: 'cscript.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'winrm'
            - 'invoke Create wmicimv2/Win32_'
            - '-r:http'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium