Common attacks and weaknesses
- Remote command execution with valid credentials.
- Lateral movement.
Port 5986: WinRM (HTTPS)
Windows Remote Management over HTTPS.
5986
How WinRM (HTTPS) works
Remote accessThe client opens a session to port 5986: each command typed is sent to the server, which runs it and returns the output. Everything is encrypted: someone on the path only sees unreadable bytes.
- Transport
- TCP · UDP
- Exposure risk
- 6/10 high if reachable from the Internet
- Encryption
- EncryptedTLS or built-in crypto
- IANA status
- Assigned1 registered service
- Range
- Registered (1024-49151)
- Category
- Remote access
Is port 5986 dangerous?
How to secure it
- Restrict to admin networks.
- Use certificate validation and MFA on admin accounts.
IANA registry entries for port 5986
| Service | Port | Transport | Description | Reference | Updated |
|---|---|---|---|---|---|
| wsmans | 5986 | TCP, UDP | WBEM WS-Management HTTP over TLS/SSL | - | 2006-11 |
// source: IANA service name and port number registry
Which program uses port 5986, and is it reachable?
Linux
sudo ss -ltnup 'sport = :5986' # process listening on 5986
sudo lsof -nP -i :5986macOS
sudo lsof -nP -i :5986
Windows (PowerShell)
Get-NetTCPConnection -LocalPort 5986 -State Listen | Select LocalAddress, OwningProcess Get-NetUDPEndpoint -LocalPort 5986 netstat -ano | findstr :5986
From another machine
nmap -p 5986 -sV <host> sudo nmap -sU -p 5986 <host> nc -zv <host> 5986
Block it in the firewall
sudo ufw deny 5986/tcp # Linux (ufw) New-NetFirewallRule -DisplayName "Block 5986" -Direction Inbound -LocalPort 5986 -Protocol TCP -Action Block # Windows
What is port 5986 used for?
Windows Remote Management over HTTPS.
Is port 5986 TCP or UDP?
Port 5986 is registered for TCP and UDP. In practice the service mostly uses TCP.
Is it safe to open port 5986?
It is rated 6/10 (high) when exposed to the Internet. Remote command execution with valid credentials. Restrict to admin networks.
How do I check if port 5986 is open?
On Linux run "ss -ltnup 'sport = :5986'", on macOS "lsof -nP -i :5986", and on Windows "netstat -ano | findstr :5986" to see the local process. From another machine, "nmap -p 5986 <host>" shows whether it is reachable.