WinRM Event ID 169 — WinRM remote connection — SecOps Tools

Why event 169 matters

WinRM is used for lateral movement (T1021.006, PowerShell remoting, Evil-WinRM). Any WinRM connection from unexpected hosts or accounts warrants investigation. Common attack tools: Evil-WinRM, PowerShell Invoke-Command, winrs.exe.

How to detect it

Alert: WinRM connections from non-admin workstations. Alert: WinRM to DCs from non-expected management hosts. Correlate with 4624 Type 3 (network logon) to the same target around the same time.

Log source

Microsoft-Windows-WinRM/Operational

Enabled with WinRM/PowerShell Remoting; channel is on by default when WinRM is configured.

Fields to pivot on

UserComputer

MITRE ATT&CK mapping

Tactic	Technique
Lateral Movement	Windows Remote Management (T1021.006)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-WinRM/Operational" and EventID == 169   // WinRM remote connection
// EventData holds: User, Computer
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-WinRM/Operational" EventCode=169
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# WinRM remote connection — add EventData fields: User, Computer`

Hunt event 169 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is WinRM Event ID 169?

WinRM remote connection. A WinRM (Windows Remote Management) session was established. Connection details including source are logged in the WinRM Operational log.

Which log records event 169?

Event 169 is written to the Microsoft-Windows-WinRM/Operational channel by Microsoft-Windows-WinRM. Enabled with WinRM/PowerShell Remoting; channel is on by default when WinRM is configured.

What MITRE ATT&CK techniques map to event 169?

Event 169 is associated with: Windows Remote Management (T1021.006).

How do you detect activity around event 169?

Alert: WinRM connections from non-admin workstations. Alert: WinRM to DCs from non-expected management hosts. Correlate with 4624 Type 3 (network logon) to the same target around the same time.