Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create
Alerts on cscript.exe executions referencing winrm and wmicimv2/Win32_ Create with -r:http, consistent with remote code execution via winrm.vbs.
- Product
- windows
- Category
- process_creation
- Author
- Julia Fomina, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-07
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of cscript.exe where the command line includes winrm-related activity to invoke a Create operation through wmicimv2/Win32_. It indicates an attempt to run winrm.vbs functionality for remote code execution or service creation on another host. The detection relies on Windows process creation telemetry, matching the image name, original file name, and required command-line substrings.
Reporting behind it
- twitter.comhttps://twitter.com/bohops/status/994405551751815170
- redcanary.comhttps://redcanary.com/blog/lateral-movement-winrm-wmi/
- lolbas-project.github.iohttps://lolbas-project.github.io/lolbas/Scripts/Winrm/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create"
id: f14f8f9c-5f84-4eea-8adb-661c3bd263ec
status: test
description: This rule flags process executions of cscript.exe where the command line includes winrm-related activity to invoke a Create operation through wmicimv2/Win32_. It indicates an attempt to run winrm.vbs functionality for remote code execution or service creation on another host. The detection relies on Windows process creation telemetry, matching the image name, original file name, and required command-line substrings.
references:
- https://twitter.com/bohops/status/994405551751815170
- https://redcanary.com/blog/lateral-movement-winrm-wmi/
- https://lolbas-project.github.io/lolbas/Scripts/Winrm/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2023-03-03
tags:
- attack.stealth
- attack.t1216
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \cscript.exe
- OriginalFileName: cscript.exe
selection_cli:
CommandLine|contains|all:
- winrm
- invoke Create wmicimv2/Win32_
- -r:http
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 9df0dd3a-1a5c-47e3-a2bc-30ed177646a0
type: derived