Windows Security Log: Detect WinRM PowerShell Remoting Inbound Connections on 5985/5986

Alerts on WinRM inbound connections (ports 5985/5986) consistent with remote PowerShell remoting activity.

FreeUnreviewedSigmahighv1

windows-security-log-detect-winrm-powershell-remoting-inbound-connections-on-598-13acf386

title: "Windows Security Log: Detect WinRM PowerShell Remoting Inbound Connections on 5985/5986"
id: 58f6e173-dcca-414f-8e6a-467bf7747731
status: test
description: This rule flags inbound network connection attempts to ports 5985 or 5986 that match Windows Security EventID 5156 with LayerRTID 44. These ports correspond to WinRM, which attackers can abuse to establish remote PowerShell sessions for command execution. It relies on firewall-related telemetry from Windows Security, capturing destination port and filtering context for the network event.
references:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_remote_powershell_session.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-09-12
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5156
    DestPort:
      - 5985
      - 5986
    LayerRTID: 44
  condition: selection
falsepositives:
  - Legitimate use of remote PowerShell execution
level: high
license: DRL-1.1
related:
  - id: 13acf386-b8c6-4fe0-9a6e-c4756b974698
    type: derived

What it detects

This rule flags inbound network connection attempts to ports 5985 or 5986 that match Windows Security EventID 5156 with LayerRTID 44. These ports correspond to WinRM, which attackers can abuse to establish remote PowerShell sessions for command execution. It relies on firewall-related telemetry from Windows Security, capturing destination port and filtering context for the network event.

Known false positives

Legitimate use of remote PowerShell execution

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.