WinRM

Synopsis

Creates an emulated WinRM endpoint that answers every request with 401 Unauthorized, driving the HTTP Negotiate/NTLM and Basic authentication handshakes far enough to capture the attacker's credentials. No WSMan or SOAP operation is ever parsed or executed.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: winrm
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    os_flavor: <string>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y		Unique identifier
name	Y		Device name
description	N	-	Optional description
type	Y		Must be winrm
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	N	"0.0.0.0"	Listen address
port	Y		Listen port. Standard WinRM HTTP is 5985.
timeout	N	20	Idle timeout in seconds

Emulation

Field	Required	Default	Description
os_flavor	N	server2019	Windows version advertised in the NTLM challenge

Accepted values are server2012, server2012r2, server2016, server2019, and server2022. Each preset supplies the NetBIOS and DNS computer and domain names, plus the Windows version reported to the client. Scanners and client tools fingerprint the host from these, so the value determines which Windows Server build the honeypot appears to be.

An unrecognized or empty value falls back to server2019 without raising a configuration error.

warning

The honeypot serves plain HTTP only. There is no TLS support and no HTTPS (5986) listener — the device reads no tls configuration keys.

note

Unlike the SMB and LDAP honeypots, WinRM reads no domain, dns_domain, or computer_name overrides. Its advertised identity comes solely from the os_flavor preset — for server2019, the NetBIOS workgroup WORKGROUP and computer name WIN-SRV2019. When deployed as part of a Domain Controller bundle, this listener advertises the preset's standalone workgroup identity while its sibling listeners advertise the shared domain identity; see the Domain Controller bundle documentation.

Details

Authentication Exchange

The server is a minimal HTTP/1.1 endpoint that only ever returns 401 Unauthorized, with a Server: Microsoft-HTTPAPI/2.0 header and Connection: keep-alive — NTLM binds to the underlying connection, so the connection must stay open across the handshake. The default challenge advertises both WWW-Authenticate: Negotiate and WWW-Authenticate: NTLM.

A request carrying a Negotiate or NTLM Authorization header with an NTLM NEGOTIATE message gets a 401 whose header carries the base64-encoded CHALLENGE built from the os_flavor preset; the server challenge is remembered for the connection. An NTLM AUTHENTICATE message is parsed for the username, domain, and workstation, logs an auth_attempt event with auth_method ntlm and the Net-NTLMv2 string, and gets another 401 — resetting the handshake so the client retries.

A Basic Authorization header is base64-decoded to the cleartext username and password, logs an auth_attempt event with auth_method basic, and gets a 401.

No WSMan or SOAP operation is ever parsed or executed — only the request method and path are logged. Request bodies are read and discarded.

Logged Events

Each connection produces one or more of the following event types:

event_type	Emitted when
connection	The first request is received on a connection
auth_attempt	An NTLM AUTHENTICATE message or a Basic Authorization header is processed

Event Fields

Every event carries timestamp, event_type, source_ip, source_port, and local_addr. The remaining fields depend on the event type:

Field	Description
http_method	HTTP method of the request
http_path	HTTP path of the request
username	Username submitted in the attempt
password	Cleartext password submitted with basic authentication
domain	Domain submitted in an NTLM AUTHENTICATE message
workstation	Workstation name submitted in an NTLM AUTHENTICATE message
auth_method	Authentication method used: ntlm or basic
netntlmv2	Crackable Net-NTLMv2 hash assembled from the challenge and response (ntlm only)
os_flavor	Configured os_flavor preset for the session

Captured Hashes

netntlmv2 is a hashcat -m 5600 Net-NTLMv2 string. basic authentication yields the cleartext password directly in password, requiring no cracking.

Examples

The following are commonly used configuration types.

Basic

Creating a minimal WinRM honeypot on the standard HTTP port...

devices: - id: 1 name: basic_winrm type: winrm properties: port: 5985

Windows Flavor

Presenting the honeypot as an older Windows Server build...

devices: - id: 2 name: winrm_2016 type: winrm properties: port: 5985 os_flavor: server2016

With Pre-Processing

Routing captured attempts through a pre-processing pipeline before ingestion...	devices: - id: 3 name: winrm_preprocessed type: winrm pipelines: - decoy-honeypot-enrich properties: port: 5985
A Basic authentication attempt is logged with the cleartext password before pipeline processing...	{ "timestamp": "2026-08-03T09:14:22.481937204Z", "event_type": "auth_attempt", "source_ip": "203.0.113.44", "source_port": "51422", "local_addr": "10.0.4.12:5985", "http_method": "POST", "http_path": "/wsman", "username": "administrator", "password": "P@ssw0rd123", "auth_method": "basic", "os_flavor": "server2019" }