Windows PowerShell script enabling WinRM via Enable-PSRemoting
Alerts on PowerShell scripts that include Enable-PSRemoting, a common step to activate WinRM for remote access.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-07
- Updated
- 2026-07-31
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell script block content containing the Enable-PSRemoting command with a trailing space, which is used to enable Windows Remote Management (WinRM) for remote access. Attackers can use this to establish remote management capability under the context of the user whose credentials are available, supporting subsequent remote actions. It relies on Script Block Logging telemetry that records the PowerShell script content executed on the host.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell script enabling WinRM via Enable-PSRemoting
id: 16c68e11-03cc-423c-a584-e1c09b6c4803
status: test
description: This rule flags PowerShell script block content containing the Enable-PSRemoting command with a trailing space, which is used to enable Windows Remote Management (WinRM) for remote access. Attackers can use this to establish remote management capability under the context of the user whose credentials are available, supporting subsequent remote actions. It relies on Script Block Logging telemetry that records the PowerShell script content executed on the host.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml
author: frack113, Huntrule Team
date: 2022-01-07
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_cmdlet:
ScriptBlockText|contains: "Enable-PSRemoting "
condition: selection_cmdlet
falsepositives:
- Legitimate script
level: medium
license: DRL-1.1
related:
- id: 991a9744-f2f0-44f2-bd33-9092eba17dc3
type: derived