Windows HackTool Activity: Evil-WinRM Ruby Process with -i, -u, -p Arguments

Flags Ruby processes launched with Evil-WinRM parameters (-i, -u, -p), indicative of WinRM remote access attempts.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-07
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.006Windows Remote Management
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation events where a Windows Ruby executable (ruby.exe) is launched with Evil-WinRM style parameters for target address (-i), username (-u), and password (-p). Such command-line patterns matter because they indicate remote WinRM-related access attempts using a tool that leverages supplied credentials. It relies on Windows process creation telemetry, specifically the executable name and command-line contents containing the required argument fragments.

Reporting behind it

Related detections9 linkedT1021.006 — drag to rearrange

Malicious Invoke-WMIExec Lateral Movement Download and Execute (via ps_script)

Windows process creation: child process spawned by winrshost.exe

Windows Winrs.exe Local Command Execution via localhost/loopback

Windows PowerShell: Invoke-Command targeting -ComputerName via script block

Windows PowerShell script enabling WinRM via Enable-PSRemoting

Zeek HTTP POST to /wsman without Authorization — Possible OMIGOD unauthenticated RCE (CVE-2021-38647)

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Windows HackTool Activity: Evil-WinRM Ruby Process with -i, -u, -p Arguments

Pivot detection · T1021.006 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-evil-winrm-ruby-process-parameters-for-winrm-login-a197e378

title: "Windows HackTool Activity: Evil-WinRM Ruby Process with -i, -u, -p Arguments"
id: 6a6543a9-5744-479a-b740-6d5a7c4393c9
status: test
description: This rule identifies process creation events where a Windows Ruby executable (ruby.exe) is launched with Evil-WinRM style parameters for target address (-i), username (-u), and password (-p). Such command-line patterns matter because they indicate remote WinRM-related access attempts using a tool that leverages supplied credentials. It relies on Windows process creation telemetry, specifically the executable name and command-line contents containing the required argument fragments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm
  - https://github.com/Hackplayers/evil-winrm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml
author: frack113, Huntrule Team
date: 2022-01-07
modified: 2023-02-13
tags:
  - attack.lateral-movement
  - attack.t1021.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ruby.exe
    CommandLine|contains|all:
      - "-i "
      - "-u "
      - "-p "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: a197e378-d31b-41c0-9635-cfdf1c1bb423
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL