Windows Process Creation: Evil-WinRM Ruby Process Parameters for WinRM Login

title: "Windows Process Creation: Evil-WinRM Ruby Process Parameters for WinRM Login"
id: 6a6543a9-5744-479a-b740-6d5a7c4393c9
status: test
description: This rule identifies Windows process creation events where a Ruby interpreter executable is invoked with Evil-WinRM-style command-line parameters for target host (-i), username (-u), and password (-p). Attackers can use these parameters to establish WinRM access using valid credentials and then execute actions remotely as the logged-on user. The detection relies on process creation telemetry capturing the executable path and full command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm
  - https://github.com/Hackplayers/evil-winrm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml
author: frack113, Huntrule Team
date: 2022-01-07
modified: 2023-02-13
tags:
  - attack.lateral-movement
  - attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ruby.exe
    CommandLine|contains|all:
      - "-i "
      - "-u "
      - "-p "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a197e378-d31b-41c0-9635-cfdf1c1bb423
    type: derived