{
  "port": 5985,
  "protocol": "tcp",
  "service": "WinRM / WS-Management over HTTP",
  "oneLiner": "Windows Remote Management — the transport behind PowerShell Remoting and winrs.",
  "whatItIs": "IANA registers 5985 as `wsman`, WBEM WS-Management over HTTP, and Microsoft adopted it as WinRM's default HTTP listener from WinRM 2.0 onward (Windows 7 / Server 2008 R2), replacing the older port 80 listener. This is what `Enter-PSSession`, `Invoke-Command`, `winrs`, and most configuration-management tooling for Windows actually talk to. No listener exists until someone runs `winrm quickconfig` or enables PowerShell Remoting, so seeing it open means the host is deliberately set up for remote administration — often a domain member, a CI build agent, or an Ansible/Puppet target.",
  "exposure": {
    "verdict": "never",
    "note": "This is a remote-code-execution plane. Even though WinRM applies message-level encryption when Negotiate/Kerberos is used, `AllowUnencrypted` and Basic auth can be switched on, and the service should be reachable only from a management network."
  },
  "checkCommand": "curl -s -o /dev/null -w '%{http_code}\\n' -m 5 http://TARGET:5985/wsman",
  "links": [
    {
      "title": "Microsoft — Installation and configuration for Windows Remote Management",
      "url": "https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management",
      "kind": "official-docs"
    },
    {
      "title": "Microsoft — Running remote commands (PowerShell Remoting)",
      "url": "https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/running-remote-commands",
      "kind": "official-docs"
    },
    {
      "title": "DMTF DSP0226 — Web Services for Management (WS-Management)",
      "url": "https://www.dmtf.org/sites/default/files/standards/documents/DSP0226_1.2.0.pdf",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 5985 (wsman)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5985",
      "kind": "iana"
    }
  ]
}