Windows Remote Management — the transport behind PowerShell Remoting and winrs.
IANA registers 5985 as wsman, WBEM WS-Management over HTTP, and Microsoft adopted it as WinRM's default HTTP listener from WinRM 2.0 onward (Windows 7 / Server 2008 R2), replacing the older port 80 listener. This is what Enter-PSSession, Invoke-Command, winrs, and most configuration-management tooling for Windows actually talk to. No listener exists until someone runs winrm quickconfig or enables PowerShell Remoting, so seeing it open means the host is deliberately set up for remote administration — often a domain member, a CI build agent, or an Ansible/Puppet target.
Do not expose
This is a remote-code-execution plane. Even though WinRM applies message-level encryption when Negotiate/Kerberos is used, AllowUnencrypted and Basic auth can be switched on, and the service should be reachable only from a management network.
$ curl -s -o /dev/null -w '%{http_code}\n' -m 5 http://TARGET:5985/wsmanSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.