T1021.006: Windows Remote Management
Summary
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Source Attribution
Source: MITRE ATT&CK · Confidence: high
Platforms
- Windows
Tactic
lateral-movement
References
- https://attack.mitre.org/techniques/T1021/006
- https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc
- https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2
- https://msdn.microsoft.com/en-us/library/aa394582.aspx
- https://learn.microsoft.com/en-us/windows/win32/winrm/portal