Win RM Child Process With Inbound Network Logon

Query

let Lookback = 1h;
let Buffer = 15m;
let MaxConnToLogon = 5m;
let KnownAutomation = datatable(RemoteIP:string, AccountName:string)
[
    "x.x.x.x", "YOURSERVICEACCOUNT"
];
let WinRMHosts = dynamic(["wsmprovhost.exe", "winrshost.exe"]);
let WinRMChildProcesses = materialize(
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName in~ (WinRMHosts)
    | where FileName !~ "conhost.exe"
    | project
        Timestamp, DeviceId, DeviceName, ReportId,
        InitiatingProcessLogonId,
        InitiatingProcessAccountDomain, InitiatingProcessAccountName,
        FileName, ProcessCommandLine,
        InitiatingProcessFileName, InitiatingProcessCommandLine
);
let RelevantDevices = WinRMChildProcesses | distinct DeviceId;
let NetworkLogons =
    DeviceLogonEvents
    | where Timestamp > ago(Lookback + Buffer)
    | where DeviceId in (RelevantDevices)
    | where ActionType == "LogonSuccess" and LogonType == "Network"
    | where isnotempty(RemoteIP) and LogonId != 0
    | extend RemoteIP = replace_string(RemoteIP, "::ffff:", "")
    | summarize arg_min(Timestamp, AccountDomain, AccountName, RemoteIP, Protocol)
        by DeviceId, InitiatingProcessLogonId = LogonId
    | project-rename LogonTime = Timestamp, LogonProtocol = Protocol;
let WinRMConnections =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback + Buffer)
    | where isnotempty(RemoteIP)
    | where DeviceId in (RelevantDevices)
    | where ActionType == "InboundConnectionAccepted" and LocalPort in (5985, 5986)
    | extend RemoteIP = replace_string(RemoteIP, "::ffff:", "")
    | where isnotempty(RemoteIP) and RemoteIP !in ("127.0.0.1", "::1")
    | project DeviceId, RemoteIP, ConnectionTime = Timestamp, WinRMPort = LocalPort;
WinRMChildProcesses
| join kind=leftouter NetworkLogons on DeviceId, InitiatingProcessLogonId
| project-away DeviceId1, InitiatingProcessLogonId1
| join kind=leftouter WinRMConnections on DeviceId, RemoteIP
| join kind=leftanti KnownAutomation on RemoteIP, AccountName
| project-away DeviceId1, RemoteIP1
| extend ConnDelta = iff(isnull(ConnectionTime) or isnull(LogonTime), 365d, abs(LogonTime - ConnectionTime))
| summarize arg_min(ConnDelta, *) by ReportId, DeviceId      // one row per process event
| extend WinRMPort = iff(ConnDelta <= MaxConnToLogon, WinRMPort, int(null))
| project
    Timestamp, DeviceId, DeviceName, ReportId,
    AccountDomain = coalesce(AccountDomain, InitiatingProcessAccountDomain),
    AccountName   = coalesce(AccountName, InitiatingProcessAccountName),
    RemoteIP, WinRMPort, LogonProtocol, LogonTime,
    FileName, ProcessCommandLine,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

About this query

Explanation

This query is designed to detect suspicious activities related to Windows Remote Management (WinRM) on devices that are onboarded with Microsoft Defender for Endpoint. Here's a simplified breakdown of what the query does:

Purpose: The query identifies child processes that are spawned by WinRM host processes (wsmprovhost.exe and winrshost.exe). These processes are then correlated with network logon events and WinRM connections to determine if they were initiated through a remote connection.
Process:
- Step 1: It starts by looking at recent process events to find child processes initiated by the WinRM hosts, excluding any processes named conhost.exe.
- Step 2: It then identifies successful network logon events that match the initiating logon ID of these processes, capturing details like the account used and the source IP address.
- Step 3: The query checks for inbound network connections on the WinRM ports (5985 and 5986) from the same source IPs, ensuring these connections are closely timed with the logon events.
Filtering: Known legitimate automation systems are filtered out using a predefined list of trusted IPs and accounts, ensuring that only potentially suspicious activities are highlighted.
Output: The result is a list of process events, each showing:
- Who executed the process (account and domain)
- What was executed (process name and command line)
- Where it was executed from (source IP)
- Over which WinRM port the connection was made, if applicable
Use Case: This query is useful for detecting lateral movement techniques and unauthorized remote command execution via WinRM, which are common tactics used by attackers. It can also help differentiate between legitimate administrative activities and potential security threats.

Overall, the query provides a comprehensive view of WinRM-related activities, allowing security analysts to investigate and respond to potential threats effectively.