Suspicious Remote PowerShell Session Host Process (WinRM) (via process_creation)

title: Suspicious Remote PowerShell Session Host Process (WinRM) (via process_creation)
id: ca714cb9-28d2-5fc4-8c82-a0df8d5ca9be
status: stable
description: This rule detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).
references:
    - https://attack.mitre.org/techniques/T1021/006/
    - https://attack.mitre.org/techniques/T1059/001/
    - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
author: Huntrule Team
date: 2026-01-24
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1059.001
    - attack.t1021.006
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\wsmprovhost.exe'
        - ParentImage|endswith: '\wsmprovhost.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium