T1021.006Lateral Movement
Windows Remote Management
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
11 Sigma rules tagged T1021.006Windows Remote ManagementT1021.00611 general rules
- OMIGOD HTTP No Authentication RCE - CVE-2021-38647highstable
- Remote LSASS Process Access Through Windows Remote Managementhighstable
- Potential Remote PowerShell Session Initiatedhightest
- Remote PowerShell Session (PS Module)hightest
- Winrs Local Command Executionhighexperimental
- Enable Windows Remote Managementmediumtest
- Execute Invoke-command on Remote Hostmediumtest
- HackTool - WinRM Access Via Evil-WinRMmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Windows Remote Management
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.