1200KM / simulation
T1021.006 Windows Remote Management — Attack Simulation
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell. WinRM can be…
Technique description
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell. WinRM can be…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Remote Code Execution with PS Credentials Using Invoke-Command
Procedure 5295bd61-bd7e-4744-9d52-85962a4cf2d6; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
- Enable Windows Remote Management
Procedure 9059e8de-3d7d-4954-a322-46161880b9cf; elevation required; cleanup not declared. Not executed or individually validated.
- WinRM Access with Evil-WinRM
Procedure efe86d95-44c4-4509-ae42-7bfd9d1f5b3d; elevation required; cleanup not declared. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.