Spotting the Adversary with Windows Event Log Monitoring

alternate methods to enable WinRM firewall exceptions. Windows Firewall with Advanced Security
policy should be enabled for all profiles.
Windows Firewall with Advanced Security policies will not be applied to Windows XP clients. The feature
is only available on systems running Windows Vista and above. [18] Windows Firewall policies targeting
Windows XP are discussed in Windows XP WinRM 2.0 Clients.
2.6.1 Collector Firewall
In Windows Server 2008 R2, Windows Firewall with Advanced Security has two predefined firewall rules
that can be enabled from the GUI or the command line. The first predefined rule, Windows Remote
Management (HTTP-In), allows network traffic to the local port 5895 on the collector for machines
running WinRM 2.0. The second predefined rule, Windows Remote Management – Compatibility
(HTTP-In), allows traffic from WinRM 0.5 and WinRM 1.1 to communicate with the collector on port 80.
The use of the WinRM compatibility firewall rule should be enabled when a compatibility listener is
configured on the collector. These predefined firewall rules should only be enabled for the domain
profile only.
2.6.1.1 Graphical User Interface
Windows Firewall with Advanced Security can be managed using two available options: local or group
policies. These graphical options are not required since configuration of the firewall was performed
during the WinRM setup.
The creation of a firewall policy for WinRM can be set using a predefined rule. Expand Computer
Configuration > Policies > Windows Settings > Security Settings > Windows Firewall with Advanced
Security > Windows Firewall with Advanced Security – ADsPath > Inbound Rules.
To enable WinRM firewall rules:
1. Right-click on Inbound Rules and select New Rule…
2. Select Windows Remote Management from the Predefined drop-down list
3. Click the Next button
4. Select Windows Remote Management – Compatibility Mode (HTTP-In) or Windows Remote
Management (HTTP-In) depending on environment setup. Select both rules if the network is
intermixed with WinRM 2.0 and WinRM 1.1 clients.
5. Click the Next button
6. Select Allow the connection
7. Click Finish
The predefined WinRM rule permits either WinRM 2.0 traffic (port 5985) or compatibility mode traffic
(port 80). The option to enable the WinRM rule in compatibility mode or not depends if the
environment is intermixed with WinRM 2.0 and WinRM 1.1 clients.
18 http://technet.microsoft.com/en-us/library/cc748991(WS.10).aspx
17