TCP Port 5985 – Windows Remote Management (WinRM HTTP)

Port 5985 carries Windows Remote Management, the Microsoft implementation of the WS-Management protocol, over HTTP. It is the transport behind PowerShell Remoting and a standard part of managing Windows servers in bulk. IANA registers the port as wsman.

About TCP Port 5985

Port 5985 is registered with the Internet Assigned Numbers Authority (IANA) for wsman. The IANA description reads: ‘WBEM WS-Management HTTP’.

Security Considerations

WinRM is a legitimate administration channel, and that is exactly why attackers who obtain any Windows credential try it early. Intrusion tooling leans on WinRM for lateral movement because activity on an approved management port blends in with normal administration. Keep 5985 restricted to management networks, prefer the HTTPS variant on port 5986 for anything that crosses less trusted segments, and never expose either port to the internet.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry.