A WBEM-over-RMI registration from the DMTF port block, with no meaningful deployment behind it.
IANA assigns 5987 to wbem-rmi, registered by Jim Davis alongside the rest of the WBEM block (5985-5990). It was intended for a Java RMI binding to a CIM object manager — the approach Sun's WBEM Services used — but CIM-XML over HTTP on 5988/5989 and WS-Management on 5985/5986 are what implementations actually settled on. A listener here is unusual; when it appears it is typically a Java management agent that opened the whole DMTF block, or an unrelated application on a free port.
Do not expose
Java RMI endpoints deserialize remote objects and have a long history of remote-code-execution flaws, and this one sits in a hardware-management block — keep it off any untrusted network.
$ nmap -Pn -sV -p 5987 TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.