WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Flags remote WinRM (wsmprovhost.exe) process-access to lsass.exe, a high-risk credential-access behavior.

FreeReviewedSigma · High · v2

Product: windows
Category: process_access
Author: Patryk Prauze - ING Tech (SigmaHQ), DRL 1.1
Published: 2019-05-20
Updated: 2026-07-31

ATT&CK techniques

Execution → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1003.001LSASS Memory
Discovery
Lateral Movement
- T1021.006Windows Remote Management
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process access to lsass.exe where the source process is wsmprovhost.exe, consistent with WinRM-mediated remote interaction. Attackers may use remote management channels to obtain credentials or support credential dumping by targeting the LSASS process. It relies on Windows process access telemetry that includes TargetImage, SourceImage, and GrantedAccess values.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Suspicious PowerShell Download of Disguised Payload to ProgramData

Suspicious PowerShell WebClient Download of Executable Payload

Malicious Script Host Spawning PowerShell in Gootloader Chain

Malicious Mimikatz Credential Dumping via Command Line Arguments

Suspicious PsExec Service Launching Encoded PowerShell Payload

Suspicious PowerShell Remote Script Execution via IEX DownloadString

WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-winrm-wsmprovhost-accessing-lsass-process-lsass-exe-remotely-aa35a627

title: WinRM Remote Access to LSASS via wsmprovhost.exe (Windows Process Access)
id: b483d773-0c48-46fa-87bb-9bff4d5b5f03
status: stable
description: This rule flags process access to lsass.exe where the source process is wsmprovhost.exe, consistent with WinRM-mediated remote interaction. Attackers may use remote management channels to obtain credentials or support credential dumping by targeting the LSASS process. It relies on Windows process access telemetry that includes TargetImage, SourceImage, and GrantedAccess values.
references:
  - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml
author: Patryk Prauze - ING Tech, Huntrule Team
date: 2019-05-20
modified: 2023-11-29
tags:
  - attack.credential-access
  - attack.execution
  - attack.t1003.001
  - attack.t1059.001
  - attack.lateral-movement
  - attack.t1021.006
  - attack.s0002
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    SourceImage|endswith: :\Windows\system32\wsmprovhost.exe
  filter_main_access:
    GrantedAccess: "0x80000000"
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: aa35a627-33fb-4d04-a165-d33b4afca3e8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL