Threat intelligence / Technique

Windows Remote Management

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)

15 recorded

Relationships

mitigates

from Disable or Remove Feature or Program

Mitigation

mitigates

from Network Segmentation

Mitigation

mitigates

from Privileged Account Management

Mitigation

revoked-by

from Windows Remote Management

Technique

subtechnique-of

to Remote Services

Technique

uses

from Brute Ratel C4

Tool

uses

Group

uses

from Cobalt Strike

Malware

uses

from FIN13

Group

uses

from Operation MidnightEclipse

Campaign

uses

from SILENTTRINITY

Tool

uses

from SolarWinds Compromise

Campaign

uses

from Storm-0501

Group

uses

from Threat Group-3390

Group

uses

from Wizard Spider

Group

5 external

References

mitre-attack

T1021.006

Medium Detecting Lateral Movement

https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc

Jacobsen 2014

https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2

MSDN WMI

https://msdn.microsoft.com/en-us/library/aa394582.aspx

Microsoft WinRM

https://learn.microsoft.com/en-us/windows/win32/winrm/portal