T1021.006 Windows Remote Management

T1021.006 Windows Remote Management

Sub-technique of: T1021

High-Level Description

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.

Kill Chain Phase

• Lateral Movement (TA0008)

Platforms: Windows

What to Check

• Identify if Windows Remote Management technique is applicable to target environment
• Check Windows systems for indicators of Windows Remote Management
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Enable Windows Remote Management

Powershell Enable WinRM

Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.

Supported Platforms: windows Elevation Required: Yes

Enable-PSRemoting -Force