New WSMan Request Activity

WSMan is an open-source, SOAP-based protocol that transports a command from a client to a tool on a remote server that will run the command. The command is wrapped in XML schemas and encrypted with a session key negotiated through the Kerberos protocol. The command is then transported over HTTP or HTTPS to the tool, which is a local implementation of WSMan. For example, the tool can be PowerShell Remoting Protocol (PSRP) or WinRM, which is the Microsoft implementation of WSMan.

An attacker who steals administrator credentials can leverage WSMan tools to run malicious commands on a remote device without installing any files. An attacker sends a WSMan request that is authenticated with a client principal name (CPN). The request contains a malicious command, which is then run by the victim. The attacker can now gain access to the victim and move laterally to new targets.