Windows process creation: child process spawned by winrshost.exe

Flags Windows process children of winrshost.exe that may indicate WinRS-driven remote command execution.

FreeUnreviewedSigmamediumv1

windows-process-creation-child-process-spawned-by-winrshost-exe-79df3f68

title: "Windows process creation: child process spawned by winrshost.exe"
id: 8ab1f668-de64-47ac-a512-782e7f688383
status: experimental
description: This rule identifies when a process is created as a child of winrshost.exe on Windows, indicating remote command execution via Windows Remote Shell (WinRS). Such activity can be used to run commands on additional hosts and may support lateral movement. It relies on Windows process creation telemetry, matching the parent executable name and excluding cases involving conhost.exe as the spawned image.
references:
  - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
  - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrshost_command_execution.yml
author: Liran Ravich, Huntrule Team
date: 2025-10-22
tags:
  - attack.lateral-movement
  - attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \winrshost.exe
  filter_main_conhost:
    Image: C:\Windows\System32\conhost.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate use of WinRM within the organization
level: medium
license: DRL-1.1
related:
  - id: 79df3f68-dccb-48e9-9171-b75cbc37c51d
    type: derived

What it detects

This rule identifies when a process is created as a child of winrshost.exe on Windows, indicating remote command execution via Windows Remote Shell (WinRS). Such activity can be used to run commands on additional hosts and may support lateral movement. It relies on Windows process creation telemetry, matching the parent executable name and excluding cases involving conhost.exe as the spawned image.

Known false positives

Legitimate use of WinRM within the organization

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.