WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

FreeReviewedSigma · High · v2

Product: windows
Category: process_access
Author: Patryk Prauze - ING Tech (SigmaHQ), DRL 1.1
Published: 2019-05-20
Updated: 2026-07-31

ATT&CK techniques

Execution → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
- T1021.006Windows Remote Management
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process access to lsass.exe where the source process is wsmprovhost.exe, consistent with WinRM-mediated remote interaction. Attackers may use remote management channels to obtain credentials or support credential dumping by targeting the LSASS process. It relies on Windows process access telemetry that includes TargetImage, SourceImage, and GrantedAccess values.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Suspicious Script Interpreter Spawned by Explorer via ClickFix Run Dialog (via process_creation)

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

Malicious WDigest Credential Caching Enabled via Registry (via registry_set)

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

Suspicious Script Download via Curl and PowerShell by Dohdoor

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winrm-wsmprovhost-accessing-lsass-process-lsass-exe-remotely-aa35a627

title: WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)
id: b483d773-0c48-46fa-87bb-9bff4d5b5f03
status: stable
description: This rule flags process access to lsass.exe where the source process is wsmprovhost.exe, consistent with WinRM-mediated remote interaction. Attackers may use remote management channels to obtain credentials or support credential dumping by targeting the LSASS process. It relies on Windows process access telemetry that includes TargetImage, SourceImage, and GrantedAccess values.
references:
  - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml
author: Patryk Prauze - ING Tech, Huntrule Team
date: 2019-05-20
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.execution
  - attack.t1003.001
  - attack.t1059.001
  - attack.lateral-movement
  - attack.t1021.006
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|endswith: :\Windows\system32\wsmprovhost.exe
  filter_main_access:
    GrantedAccess: "0x80000000"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: aa35a627-33fb-4d04-a165-d33b4afca3e8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL