{"id":"df9a0e0e-fedb-4d6c-8668-d765dfc92aa7","title":"Suspicious Non PowerShell WSMAN COM Provider","description":"Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-06-24","modified":"2025-10-22","tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.003"],"technique_ids":["T1021.003","T1059.001"],"logsource":{"product":"windows","service":"powershell-classic"},"falsepositives":["Unknown"],"references":["https://twitter.com/chadtilbury/status/1275851297770610688","https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/","https://github.com/bohops/WSMan-WinRM"],"source_path":"rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml","source_sha256":"7fd60d2d0e4d19a94cc0b68e8f15c7cf4d75595b5d8d0a3735772e460ab6a667","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Non PowerShell WSMAN COM Provider\nid: df9a0e0e-fedb-4d6c-8668-d765dfc92aa7\nstatus: test\ndescription: Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.\nreferences:\n    - https://twitter.com/chadtilbury/status/1275851297770610688\n    - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/\n    - https://github.com/bohops/WSMan-WinRM\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-06-24\nmodified: 2025-10-22\ntags:\n    - attack.execution\n    - attack.t1059.001\n    - attack.lateral-movement\n    - attack.t1021.003\nlogsource:\n    product: windows\n    service: powershell-classic\ndetection:\n    selection:\n        Data|contains: 'ProviderName=WSMan'\n    filter_main_ps:\n        Data|contains:\n            - 'HostApplication=powershell'\n            - 'HostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell'\n            - 'HostApplication=C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell'\n            # In some cases powershell was invoked with inverted slashes\n            - 'HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell'\n            - 'HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'\n    filter_main_host_application_null:\n        # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the \"HostApplication\" field is null (i.e doesn't exist). We're practically forced to use a regex.\n        # If you're already mapping and extracting the field, then obviously use that directly.\n        Data|re: 'HostId=[a-zA-Z0-9-]{36}\\s+EngineVersion='\n    filter_optional_hexnode:\n        Data|contains: 'HostApplication=C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.003","id":"T1021.003","name":"Distributed Component Object Model","page":"techniques/enterprise/T1021.003/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/df9a0e0e-fedb-4d6c-8668-d765dfc92aa7.json","kind":"sigma"}