Windows PowerShell Classic Logs: Suspicious WSMAN COM Provider Use Without PowerShell Host

title: "Windows PowerShell Classic Logs: Suspicious WSMAN COM Provider Use Without PowerShell Host"
id: af5ed5e6-8971-47fc-a3dc-c9e6b984df8f
status: test
description: This rule flags events where PowerShell Classic data contains ProviderName=WSMan, but the host application is not PowerShell.exe. Attackers may use the WSMAN COM provider to execute WinRM-related actions while avoiding straightforward PowerShell.exe visibility, which can help lateral movement blend in. It relies on Windows PowerShell Classic event telemetry containing the raw Data field with ProviderName=WSMan and HostApplication values.
references:
  - https://twitter.com/chadtilbury/status/1275851297770610688
  - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/
  - https://github.com/bohops/WSMan-WinRM
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-06-24
modified: 2025-10-22
tags:
  - attack.execution
  - attack.t1059.001
  - attack.lateral-movement
  - attack.t1021.003
logsource:
  product: windows
  service: powershell-classic
detection:
  selection:
    Data|contains: ProviderName=WSMan
  filter_main_ps:
    Data|contains:
      - HostApplication=powershell
      - HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell
      - HostApplication=C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell
      - HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell
      - HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell
  filter_main_host_application_null:
    Data|re: HostId=[a-zA-Z0-9-]{36}\s+EngineVersion=
  filter_optional_hexnode:
    Data|contains: HostApplication=C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: df9a0e0e-fedb-4d6c-8668-d765dfc92aa7
    type: derived