t1021-006-windows-remote-management

name	T1021.006_windows-remote-management
description	Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM).
category	authorization
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1021.006","lateral-movement","windows","sub-technique"]
technique_id	T1021.006
tactic	lateral-movement
all_tactics	["lateral-movement"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1021/006
tech_stack	["windows"]
cwe_ids	["CWE-284"]
chains_with	["T1021","T1021.001","T1021.002","T1021.003","T1021.004","T1021.005","T1021.007","T1021.008"]
prerequisites	["T1021"]
severity_boost	{"T1021":"Chain with T1021 for deeper attack path","T1021.001":"Chain with T1021.001 for deeper attack path","T1021.002":"Chain with T1021.002 for deeper attack path"}

T1021.006 Windows Remote Management

Sub-technique of: T1021

High-Level Description

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.

Kill Chain Phase

• Lateral Movement (TA0008)

Platforms: Windows

What to Check

• Identify if Windows Remote Management technique is applicable to target environment
• Check Windows systems for indicators of Windows Remote Management
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Enable Windows Remote Management

Powershell Enable WinRM

Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.

Supported Platforms: windows Elevation Required: Yes

Enable-PSRemoting -Force

Atomic Test 2: Remote Code Execution with PS Credentials Using Invoke-Command

Simulate lateral movement with PowerShell Remoting on the local host. Upon successful execution, PowerShell will execute whoami using Invoke-Command, targeting the local machine as remote target.

Supported Platforms: windows

Enable-PSRemoting -Force
Invoke-Command -ComputerName $env:COMPUTERNAME -ScriptBlock {whoami}

Atomic Test 3: WinRM Access with Evil-WinRM

An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled