Spotting the Adversary with Windows Event Log Monitoring

Parameters
MaxEnvelopeSizekb
MaxTimeoutms
MaxBatchItems
MaxProviderRequests
Description
The Simple Object Access Protocol (SOAP) data size has maximum in
kilobytes
Default is 150 kilobytes
Each push request (not pull) has a maximum timeout. This value is in
milliseconds.
Default is 60000ms (60 seconds)
The limit of elements used in a pull response.
Default for WinRM 1.1 and earlier: 20
Default for WinRM 2.0: 32000
The limit on concurrent requests.
Default for WinRM 1.1 and earlier: 25
Default for WinRM 2.0: Unsupported/Undefined
Table 22: Protocol Settings
7.4.2 Client Configuration
The following parameters configures on how the WinRM client operates.
Parameters
NetworkDelayms
URLPrefix
AllowUnencrypted
Description
A time buffer for the client computer to wait in milliseconds.
Default WinRM 1.1 and earlier: 5000
Default WinRM 2.0: 5000
The type of URLPrefix used on request for HTTP or HTTPS requests.
Default WinRM 1.1 and earlier: wsman
Default WinRM 2.0: wsman
Clients are allowed to request unencrypted traffic.
Default WinRM 1.1 and earlier: false
Default WinRM 2.0: false
Auth
Specifies which authentication method is allowed for the client computer
DefaultPorts Default WinRM 1.1 and earlier: HTTP = 80, HTTPS = 443
Default WinRM 2.0: HTTP = 5985, HTTPS = 5986
TrustedHosts These trusted hosts do not need to be authenticated.
Table 23: WinRM Client Configuration
7.4.3 WinRM Service
54