How WinRM and PowerShell Remoting Work, and Lateral Movement (Animated)
WinRM lets administrators run commands and PowerShell on remote Windows machines, the backbone of a lot of IT automation. Because it is built-in, trusted and powerful, attackers who steal an admin password use the very same channel to move from server to server.
1. Connect: an http request carrying soap
WinRM is web services over HTTP: the client posts a SOAP message to /wsman on port 5985 (or 5986 with TLS), authenticating with Kerberos.
- POST /wsman (Admin jump host → Windows server): Authentication uses the admin’s domain identity.
- 200 OK (Windows server → Admin jump host): A remote PowerShell session opens.
Wireshark filter:
tcp.port == 5985
2. Run commands: commands in, output out
Each command and its output travel as encrypted SOAP messages.
- COMMAND (Admin jump host → Windows server): The admin runs a command.
- OUTPUT (Windows server → Admin jump host): Output returns, and the server can log every script block.
Wireshark filter:
http.request.uri == "/wsman"
3. Lateral movement: attack: same channel, stolen credentials
An attacker who has stolen an admin’s credentials from one machine uses WinRM to run commands on the next, and the next. To the network it looks just like normal administration, which is why logs and restrictions matter.
- POST /wsman (Attacker (stolen admin login) → Windows server): Valid credentials, unusual source.
- 200 OK (Windows server → Attacker (stolen admin login)): The attacker can now run anything on the server.
Wireshark filter:
tcp.port == 5985 && ip.src == 192.168.1.66
4. Restrict & log: defence: only from admin hosts, always logged
Allow WinRM only from dedicated admin jump hosts (firewall), use HTTPS, limit what each role can run with Just Enough Administration, turn on PowerShell logging, and alert on remoting from ordinary workstations.
- POST /wsman (Attacker (stolen admin login) → Windows server): Stolen credentials are no longer enough: the source isn’t allowed, and the SOC is alerted.
Firewall + logging:
Allow TCP 5985/5986 only from the admin jump-host subnet Turn on PowerShell Script Block Logging (Event 4104)
Practise this in a real lab
Use PowerShell Remoting in a lab domain, see what it looks like in the logs, then restrict it to admin jump hosts and Just Enough Administration.
Explore ER Segment training →FAQ
Which ports does WinRM use?
5985 for HTTP and 5986 for HTTPS. Even on 5985, messages are encrypted when Kerberos or NTLM authentication is used.
What is lateral movement?
Moving from one compromised machine to others inside the network, usually with stolen credentials and legitimate admin tools.
Which logs show PowerShell activity?
PowerShell Script Block Logging (Event ID 4104), WinRM operational logs, and Security logon events (4624, logon type 3).