{"id":"bcfece3d-56fe-4545-9931-3b8e92927db1","title":"Winrs Local Command Execution","description":"Detects the execution of Winrs.exe where it is used to execute commands locally.\nCommands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.\n","author":"Liran Ravich, Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-10-22","modified":"","tags":["attack.lateral-movement","attack.stealth","attack.t1021.006","attack.t1218"],"technique_ids":["T1021.006","T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs"],"source_path":"rules/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml","source_sha256":"b8212e45f18402b929914eb9e16cab9ae79cb2d838e1aca98157ad3957833b9c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Winrs Local Command Execution\nid: bcfece3d-56fe-4545-9931-3b8e92927db1\nstatus: experimental\ndescription: |\n    Detects the execution of Winrs.exe where it is used to execute commands locally.\n    Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.\nreferences:\n    - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs\nauthor: Liran Ravich, Nasreddine Bencherchali\ndate: 2025-10-22\ntags:\n    - attack.lateral-movement\n    - attack.stealth\n    - attack.t1021.006\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        # Note: Example of command to simulate (winrm needs to be enabled): \"c:\\Windows\\System32\\winrs.exe\" calc.exe\n        - Image|endswith: '\\winrs.exe'\n        - OriginalFileName: 'winrs.exe'\n    selection_local_ip:\n        CommandLine|contains|windash:\n            - '/r:localhost'\n            - '/r:127.0.0.1'\n            - '/r:[::1]'\n            - '/remote:localhost'\n            - '/remote:127.0.0.1'\n            - '/remote:[::1]'\n    filter_main_remote:\n        CommandLine|contains|windash:\n            - \"/r:\"\n            - \"/remote:\"\n    condition: all of selection_* or (selection_img and not 1 of filter_main_*)\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.006","id":"T1021.006","name":"Windows Remote Management","page":"techniques/enterprise/T1021.006/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/bcfece3d-56fe-4545-9931-3b8e92927db1.json","kind":"sigma"}