Spotting the Adversary with Windows Event Log Monitoring

Figure 24: Subscription Manager Policy Supported OS Version
Figure 25: WinRM Listener Policy Supported OS Version
7.10.1 Installation of WinRM 1.1 on Windows Server 2003 R2
The installation of WinRM 1.1 on a Windows Server 2003 R2 can be done using an update from
Microsoft. The update URL can be found in Windows Remote Management Versions section. It is
possible to install WinRM using the Windows Server 2003 R2 installation CD; however, this will install
WinRM 0.5. [94] Installing and using WinRM 2.0 is recommended.
8 Works Cited
Distributed Management Task Force, Inc. (2008, 02 12). Web Services for Management (WS-
Management) Specification. Retrieved 10 01, 2012, from Distributed Management Task Force, Inc.:
http://www.dmtf.org/standards/published_documents/DSP0226_1.0.0.pdf
Microsoft Corporation. (2012, 07 12). [MS-CSSP]:Credential Security Support Provider (CredSSP) Procotol.
Retrieved 10 01, 2012, from Microsoft MSDN: http://msdn.microsoft.com/enus/library/cc226764(v=prot.20).aspx
Microsoft Corporation. (2012, 07 15). [MS-ERREF]: Windows Error Codes. Retrieved 10 01, 2012, from
Microsoft MSDN: http://msdn.microsoft.com/en-us/library/cc231196.aspx
Microsoft Corporation. (2012, 7 5). [MS-WSMV]: Web Services Management Protocol Extensions for
Windows Vista. Retrieved 10 01, 2012, from Microsoft MSDN: http://msdn.microsoft.com/enus/library/cc251526(prot.20).aspx
Microsoft Corporation. (2011, 10 8). An update is available for the Windows Remote Management
feature in Windows Server 2003 and in Windows XP. Retrieved 10 01, 2012, from Microsoft Support:
http://support.microsoft.com/kb/KB936059
Microsoft Corporation. (2012, 10 16). Setting up a Source Initiated Subscription. Retrieved 10 01, 2012,
from MSDN Library: http://msdn.microsoft.com/en-us/library/bb870973(VS.85).aspx
94 http://technet.microsoft.com/en-us/library/cc781099.aspx
67