3.1.12.4.5. WinRM Connections

The WinRM (Windows Remote Management) Connection dashboard display various metrics and insights related to the prevention of lateral movements through WinRM and unauthorized remote access.

The view displays the following dashboards:

../../../../_images/winrm_connections.png

  • Total WinRM connections: Metric showing total WinRM connections.

  • Total WinRM clients: Metric showing the total number of unique clients on WinRM connections.

  • Total WinRM servers: Metric showing the total number of unique servers on WinRM connections.

  • Total WinRM connections time evolution: Histogram showing the temporal evolution of WinRM connections. The bars are segmented by unencrypted (HTTP, port TCP 5985) or encrypted (HTTPS, port TCP 5986).

  • WinRM connections encryption distribution: Tree map showing the distribution of the encryption in WinRM connections: unencrypted (HTTP, port TCP 5985) or encrypted (HTTPS, port TCP 5986).

  • Types of WinRM clients: Tree map showing the distribution of the different types of WinRM clients.

  • Total WinRM clients time evolution: Histogram showing the time evolution of total unique WinRM clients.

../../../../_images/winrm2.png

  • Top 10 WinRM clients: Bar chart showing the top 10 WinRM clients by the total number of WinRM connections. Each bar indicates the WinRM connections for a specific client IP address and is segmented by unencrypted (HTTP, port TCP 5985) or encrypted (HTTPS, port TCP 5986).

  • Top 10 WinRM servers: Bar chart showing the top 10 WinRM servers by the total number of WinRM connections. Each bar indicates the WinRM connections for a specific client IP address and is segmented by unencrypted (HTTP, port TCP 5985) or encrypted (HTTPS, port TCP 5986).

  • WinRM connections flow: Sankey diagram showing the flow of WinRM connections between source and destination IP addresses. Each line represents the number of connections from a specific source IP on the right. Different colors indicate the various connections paths.

../../../../_images/winrm3.png

  • WinRM connections details: Table showing the following information of WinRM connections: dates, device info (MAC, IP, type), user, switch details (IP, port), and building and network names.