Port 5985 (WinRM (HTTP))
Windows Remote Management, used by PowerShell remoting (HTTPS on 5986).
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- A favourite lateral movement channel (Evil-WinRM, Enter-PSSession).
- Restrict to admin hosts.
When it shows up in your logs
WinRM from a non-admin workstation to servers can be lateral movement.