T1021.006 Windows Remote Management — ATT&CK Technique
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.
Detection coverage (20)
- Potential Remote PowerShell Session Initiated high
- Remote PowerShell Session (PS Classic) low
- Remote PowerShell Session (PS Module) high
- Enable Windows Remote Management medium
- Execute Invoke-command on Remote Host medium
- Remote LSASS Process Access Through Windows Remote Management high
- HackTool - WinRM Access Via Evil-WinRM medium
- Remote PowerShell Session Host Process (WinRM) medium
- Winrs Local Command Execution high
- Potential Lateral Movement via Windows Remote Shell medium
- Remote Process Instantiation via WinRM and PowerShell
- Remote Process Instantiation via WinRM and PowerShell Script Block
- Remote Process Instantiation via WinRM and Winrs
- Interactive Session on Remote Endpoint with PowerShell
- Possible Lateral Movement PowerShell Spawn
- Powershell Remote Services Add TrustedHost
- Windows Remote Host Computer Management Access
- Windows Remote Management Execute Shell
- Wsmprovhost LOLBAS Execution Process Spawn
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647 high