- Tactics
- Lateral Movement
- Platforms
- Windows
- Reference
- attack.mitre.org/techniques/T1021.006
Description
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the winrm command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.(Citation: MSDN WMI)
How GTK Cyber trains on this
GTK Cyber's Threat Hunting with Data Science course teaches you to build machine-learning detections for techniques like this across the MITRE ATT&CK framework, including the Lateral Movement tactic this technique falls under. Practitioner-led, focused on real detections, not memorizing technique IDs.
Related techniques
- T1021 - Remote Services
- T1072 - Software Deployment Tools
- T1080 - Taint Shared Content
- T1091 - Replication Through Removable Media
- T1210 - Exploitation of Remote Services
- T1534 - Internal Spearphishing
- T1550 - Use Alternate Authentication Material
- T1563 - Remote Service Session Hijacking
- T1570 - Lateral Tool Transfer