wsmprovhost.exe

Top Paths

• C:\Windows\System3299.99%
• C:\Windows\SysWOW640.01%

Top Hashes (SHA256)

• 7edeac6904c1648e6c396b785c88cc9131fcde687f916fd36b012654d425b96551.36%
• 5fccff57d379cdc4cf6196fef554cef753b4c76dc315f371f90aebf07b6a18c329.71%
• d04cec55a06f6a326ff1e119f429d7508378caeada1da306fa8a449757753c6d13.13%
• 91010bc419fc8fbe3d6483bf40788a9980a665f254e37d0d995bcfce04f93b6d2.49%
• 14420c88b77881329c7e20e978ac9cb8f5f8d4670a174f220ca3e129939e72c01.25%
• fb45452760bff8eedc460e0cb1205f64dac9cbd15db0f39388b13ae2a52d5f571.11%
• 9994690e6ba9b7f8433a97305f7818fd94a514c39e50b56b3562148bfca731110.82%
• bd3b152360dd02844ca61e2bb534d7bdb23580c8047537bde49c547255b8f4450.08%
• e9a131cad8500e62e3612a62fb7e222c5637e63abcb98fb886753460c4fc1c360.05%
• 69776c5130abe543ee60a8277f5403455a0e990322e89c84a9e68a680a9cc9f20.01%

Top Grandparents

• services.exe99.82%
• cmd.exe0.18%

Top Parents

• svchost.exe99.99%
• python.exe0.01%

Top Children

• appcmd.exe99.73%
• HOSTNAME.EXE0.12%
• findstr.exe0.05%
• NETSTAT.EXE0.03%
• whoami.exe0.02%
• net.exe0.01%
• cmd.exe0.01%
• csc.exe<0.01%
• systeminfo.exe<0.01%

What does wsmprovhost.exe normally do?

Located in C:\Windows\System32. Launched by svchost.exe (WinRM service). One instance per remote PowerShell session.

When is wsmprovhost.exe suspicious?

Any child process spawned by wsmprovhost.exe represents a command executed via a remote PowerShell session. Shells, reconnaissance tools, and file operations from wsmprovhost.exe indicate remote command execution. High-value indicator for lateral movement.

How do attackers abuse wsmprovhost.exe?

PowerShell remoting lateral movement: attackers with valid credentials use Invoke-Command or Enter-PSSession to execute commands on remote hosts. All commands execute as children of wsmprovhost.exe on the target. This is a legitimate, built-in remote execution mechanism, making it difficult to distinguish from admin activity without additional context.

Detection guidance

High-confidence: wsmprovhost.exe spawning reconnaissance tools (whoami, net, ipconfig, nltest). wsmprovhost.exe spawning processes from temp or user profile directories. Medium-confidence: any wsmprovhost.exe child process in environments where PowerShell remoting is not the primary admin method. Correlate with Windows Event ID 4624 Type 3 (network logon) and PowerShell Operational logs (Event ID 4104) on the target host.

False positive notes

Common in environments that use PowerShell remoting for administration (SCCM, DSC, custom management scripts). appcmd.exe as a child is common for IIS management via remoting. Requires environmental context — is PowerShell remoting expected on this host?

MITRE ATT&CK techniques