wsmprovhost.exe
Sources: 300M+ executions observed in the wild.
Summary
WinRM (Windows Remote Management) Provider Host handles PowerShell remoting sessions. When a remote PowerShell session (Enter-PSSession, Invoke-Command) connects to a machine, wsmprovhost.exe hosts the remote session on the target.
wsmprovhost.exe is the 188th most commonly executed Windows program in EchoTrail's dataset, observed 82,345 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Get this in your tools
The same record for wsmprovhost.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/wsmprovhost.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3299.99%
- C:\Windows\SysWOW640.01%
Top Hashes (SHA256)
- 7edeac6904c1648e6c396b785c88cc9131fcde687f916fd36b012654d425b96551.36%
- 5fccff57d379cdc4cf6196fef554cef753b4c76dc315f371f90aebf07b6a18c329.71%
- d04cec55a06f6a326ff1e119f429d7508378caeada1da306fa8a449757753c6d13.13%
- 91010bc419fc8fbe3d6483bf40788a9980a665f254e37d0d995bcfce04f93b6d2.49%
- 14420c88b77881329c7e20e978ac9cb8f5f8d4670a174f220ca3e129939e72c01.25%
- fb45452760bff8eedc460e0cb1205f64dac9cbd15db0f39388b13ae2a52d5f571.11%
- 9994690e6ba9b7f8433a97305f7818fd94a514c39e50b56b3562148bfca731110.82%
- bd3b152360dd02844ca61e2bb534d7bdb23580c8047537bde49c547255b8f4450.08%
- e9a131cad8500e62e3612a62fb7e222c5637e63abcb98fb886753460c4fc1c360.05%
- 69776c5130abe543ee60a8277f5403455a0e990322e89c84a9e68a680a9cc9f20.01%
Process Ancestry
Top Grandparents
- services.exe99.82%
- cmd.exe0.18%
Top Parents
- svchost.exe99.99%
- python.exe0.01%
Top Children
- appcmd.exe99.73%
- HOSTNAME.EXE0.12%
- findstr.exe0.05%
- NETSTAT.EXE0.03%
- whoami.exe0.02%
- net.exe0.01%
- cmd.exe0.01%
- csc.exe<0.01%
- systeminfo.exe<0.01%
Security Analysis
What does wsmprovhost.exe normally do?
Located in C:\Windows\System32. Launched by svchost.exe (WinRM service). One instance per remote PowerShell session.
When is wsmprovhost.exe suspicious?
Any child process spawned by wsmprovhost.exe represents a command executed via a remote PowerShell session. Shells, reconnaissance tools, and file operations from wsmprovhost.exe indicate remote command execution. High-value indicator for lateral movement.
How do attackers abuse wsmprovhost.exe?
PowerShell remoting lateral movement: attackers with valid credentials use Invoke-Command or Enter-PSSession to execute commands on remote hosts. All commands execute as children of wsmprovhost.exe on the target. This is a legitimate, built-in remote execution mechanism, making it difficult to distinguish from admin activity without additional context.
Detection guidance
High-confidence: wsmprovhost.exe spawning reconnaissance tools (whoami, net, ipconfig, nltest). wsmprovhost.exe spawning processes from temp or user profile directories. Medium-confidence: any wsmprovhost.exe child process in environments where PowerShell remoting is not the primary admin method. Correlate with Windows Event ID 4624 Type 3 (network logon) and PowerShell Operational logs (Event ID 4104) on the target host.
False positive notes
Common in environments that use PowerShell remoting for administration (SCCM, DSC, custom management scripts). appcmd.exe as a child is common for IIS management via remoting. Requires environmental context — is PowerShell remoting expected on this host?
Related Processes
Ask Rocky about wsmprovhost.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for wsmprovhost.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.