🐾 - 🚨 WinRM 🪟 authenticated session from unusual URL (no PSVersion sent)- like evil-winrm 🥷 - T1021.006 - Suricata Rule 3321497 (pawpatrules)

🐾 - 🚨 WinRM 🪟 authenticated session from unusual URL (no PSVersion sent)- like evil-winrm 🥷 - T1021.006

SID: 3321497Rev: 1Enabled0 views

FilePAW-PATRULES_LATERAL_MOVEMENT.rules

CreatedOctober 8, 2026

UpdatedOctober 8, 2026

Classificationsuccessful-admin

alert http any any -> any 80,5985 (msg:"🐾 - 🚨 WinRM 🪟 authenticated session from unusual URL (no PSVersion sent)- like evil-winrm 🥷 - T1021.006"; flow:to_server, stateless; http.protocol; content:"HTTP/1.1"; http.method; content:"POST"; http.uri; content:"/wsman"; http.header.raw; content:"|6d 75 6c 74 69 70 61 72 74 2f 65 6e 63 72 79 70 74 65 64 3b 70 72 6f 74 6f 63 6f 6c 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 48 54 54 50 2d|"; fast_pattern; http.uri; content:!"?PSVersion"; reference:url,https://attack.mitre.org/techniques/T1021/006/; reference:url,https://github.com/Hackplayers/evil-winrm; metadata:created_at 2026_10_08, updated_at 2026_10_08, signature_severity Minor, attack_target Server, affected_product Windows_XP_Vista_7_8_10_11_Server_32_64_Bit, mitre_tactic_id T1021, mitre_tactic_name Lateral_Movement, mitre_technique_id T1021_006, mitre_technique_name Windows_Remote_Management; sid:3321497; rev:1; classtype:successful-admin;)

References

url	https://attack.mitre.org/techniques/T1021/006/
url	https://github.com/Hackplayers/evil-winrm

Metadata

created at2026_10_08

updated at2026_10_08

signature severityMinor

attack targetServer

affected productWindows_XP_Vista_7_8_10_11_Server_32_64_Bit

mitre tactic idT1021

mitre tactic nameLateral_Movement

mitre technique idT1021_006

mitre technique nameWindows_Remote_Management

Comments (0)

Please sign in to leave a comment.

No comments yet. Be the first to comment!