Suspicious WSMAN Provider Image Loads

{
  "request_client": [
    {
      "ImageLoaded
| endswith": [
        "\\WsmSvc.dll",
        "\\WsmAuto.dll",
        "\\Microsoft.WSMan.Management.ni.dll"
      ]
    },
    {
      "OriginalFileName": [
        "WsmSvc.dll",
        "WSMANAUTOMATION.DLL",
        "Microsoft.WSMan.Management.dll"
      ]
    }
  ],
  "respond_server": {
    "Image
| endswith": "\\svchost.exe",
    "OriginalFileName": "WsmWmiPl.dll"
  },
  "filter_general": {
    "Image": [
      "C:\\Program Files (x86)\\PowerShell\\6\\pwsh.exe",
      "C:\\Program Files (x86)\\PowerShell\\7\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\6\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\sdiagnhost.exe",
      "C:\\Windows\\System32\\services.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_svchost": {
    "CommandLine
| contains": [
      "svchost.exe -k netsvcs -p -s BITS",
      "svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc",
      "svchost.exe -k NetworkService -p -s Wecsvc",
      "svchost.exe -k netsvcs"
    ]
  },
  "filter_mscorsvw": {
    "Image
| startswith": [
      "C:\\Windows\\Microsoft.NET\\Framework64\\v",
      "C:\\Windows\\Microsoft.NET\\Framework\\v",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm\\v",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm64\\v"
    ],
    "Image
| endswith": "\\mscorsvw.exe"
  },
  "filter_gethelp": {
    "Image
| startswith": "C:\\Program Files\\WindowsApps\\Microsoft.GetHelp_",
    "Image
| endswith": "\\GetHelp.exe"
  },
  "filter_svr_2019": {
    "Image": [
      "C:\\Windows\\System32\\Configure-SMRemoting.exe",
      "C:\\Windows\\System32\\ServerManager.exe"
    ]
  },
  "filter_nextron": {
    "Image
| startswith": "C:\\Windows\\Temp\\asgard2-agent\\"
  },
  "filter_citrix": {
    "Image
| startswith": "C:\\Program Files\\Citrix\\"
  },
  "filter_upgrade": {
    "Image
| startswith": "C:\\$WINDOWS.~BT\\Sources\\"
  },
  "filter_mmc": {
    "Image
| endswith": "\\mmc.exe"
  },
  "svchost": {
    "Image
| endswith": "\\svchost.exe"
  },
  "commandline_null": {
    "CommandLine": null
  },
  "condition": "( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null )"
}

False Positives

• ⚠ Unknown