Sigma rule: Suspicious WSMAN Provider Image Loads

Rule

Title

Suspicious WSMAN Provider Image Loads

Status

test

Level

medium

Author

Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)

Date

2020-06-24

Modified

2026-07-28

File

rules/windows/image_load/image_load_wsman_provider_image_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Log source

product

windows

category

image_load

Detection

request_client:
    - ImageLoaded|endswith:
          - '\WsmSvc.dll'
          - '\WsmAuto.dll'
          - '\Microsoft.WSMan.Management.ni.dll'
    - OriginalFileName:
          - 'WsmSvc.dll'
          - 'WSMANAUTOMATION.DLL'
          - 'Microsoft.WSMan.Management.dll'
respond_server:
    Image|endswith: '\svchost.exe'
    OriginalFileName: 'WsmWmiPl.dll'
filter_general:
    Image:
        - 'C:\Program Files (x86)\PowerShell\6\pwsh.exe'
        - 'C:\Program Files (x86)\PowerShell\7\pwsh.exe'
        - 'C:\Program Files\PowerShell\6\pwsh.exe'
        - 'C:\Program Files\PowerShell\7\pwsh.exe'
        - 'C:\Windows\System32\sdiagnhost.exe'
        - 'C:\Windows\System32\services.exe'
        - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
        - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
filter_svchost: # not available in Sysmon data, but Aurora logs
    CommandLine|contains:
        - 'svchost.exe -k netsvcs -p -s BITS'
        - 'svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc'
        - 'svchost.exe -k NetworkService -p -s Wecsvc'
        - 'svchost.exe -k netsvcs'
filter_mscorsvw: # Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
    Image|startswith:
        - 'C:\Windows\Microsoft.NET\Framework64\v'
        - 'C:\Windows\Microsoft.NET\Framework\v'
        - 'C:\Windows\Microsoft.NET\FrameworkArm\v'
        - 'C:\Windows\Microsoft.NET\FrameworkArm64\v'
    Image|endswith: '\mscorsvw.exe'
filter_gethelp:
    Image|startswith: 'C:\Program Files\WindowsApps\Microsoft.GetHelp_'
    Image|endswith: '\GetHelp.exe'
filter_svr_2019:
    Image:
        - 'C:\Windows\System32\Configure-SMRemoting.exe'
        - 'C:\Windows\System32\ServerManager.exe'
filter_nextron:
    Image|startswith: 'C:\Windows\Temp\asgard2-agent\'
filter_citrix:
    Image|startswith: 'C:\Program Files\Citrix\'
filter_upgrade:
    Image|startswith: 'C:\$WINDOWS.~BT\Sources\'
filter_mmc:
    Image|endswith: '\mmc.exe'
svchost:
    Image|endswith: '\svchost.exe'
commandline_null:
    CommandLine: null
condition: ( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null )

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001
• attack.lateral-movement
• attack.t1021.003

MITRE ATT&CK ids this rule names

• T1021.003
• T1059.001

References

• https://twitter.com/chadtilbury/status/1275851297770610688
• https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/
• https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture
• https://github.com/bohops/WSMan-WinRM

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_wsman_provider_image_load.yml