Windows - Wsmprovhost LOLBAS execution mitigation

Entities: Process name Log type: Windows Server

In this page

Playbook Description

This playbook mitigates WSMProvHost LOLBAS execution by verifying the process reputation and process tree to confirm malicious activity. It stops the attack by killing and quarantining the malicious process, blocks lateral movement by disabling WinRM, and eliminates persistence by removing malicious scheduled tasks and logging off the compromised user. It also runs a Defender scan to validate remediation and notifies the security team with the investigation or remediation outcome.

MITRE ATT&CK mapping

Tactics Techniques Sub-techniques
Lateral Movement(TA0008) Remote Services(T1021) Windows Remote Management(T1021.006)

MITRE D3FEND mapping

Tactics Techniques Sub-techniques
Isolate(D3-Isolate) Network Isolation(D3-NI) -

Playbook input type

Alert

Dependencies

Utility functions:

  • utility_convertTimeToUTC
  • utility_getRequiredTime
  • windows_detectMaliciousProcessChain
  • utility_sendMail

Scripts

Script Name Description Arguments
StopAndQuarantineProcess.ps1 Terminates processes by PID (decimal/hex) or by executable file path, then quarantines the executable to a forensic directory. Protects critical OS processes and the SOAR agent from termination. ProcessIdentifiers
DisableWinRM.ps1 Disables PowerShell Remoting and stops/disables the WinRM service. -
TerminateSession.ps1 Logs off one or more user sessions using logoff, with optional RDP-only filtering by remote IP. userName
FetchPersistenceEntries.ps1 Scans for persistence mechanisms including scheduled tasks, registry Run/RunOnce keys, startup folder entries, and services to identify potential malicious persistence. -

Sub playbooks

  • Windows - Defender Quick Scan

Execution workflow

Investigation:

  • Fetches the process tree.
  • Checks the process reputation.

Decision logic:

  • Proceeds to remediation based on the following conditions:
    • A malicious execution flow was detected in the process tree.
  • If suspicious but not confirmed malicious, sends a notification for manual review and stops further actions.
  • If no malicious indicators are confirmed, the playbook ends with no further actions.

Remediation:

  • Terminates and quarantines the malicious process.
  • Disables and logs off the user.
  • Disables WinRM.
  • Removes malicious and scheduled task.
  • Executes the "Windows Defender quick scan" sub-playbook.
  • Checks if any remediation failed.
  • Builds the notification email with remediation details and findings.
  • Sends a notification email regarding the actions taken and required next steps.
Execution Workflow
Figure: Execution workflow of the playbook

Post execution procedure

  • Investigate whether the LOLBAS execution was part of a larger attack chain.
  • Review WinRM configuration and re-enable only if necessary with proper restrictions.
  • Audit the affected user account for unauthorized changes.
  • Monitor the host for recurring alerts.