tfMITRE ATT&CK sub-technique

Windows Remote Management T1021.006

Tactic: Lateral Movement
Platform: Windows
Version: 1.2
Created: 11 February 2020
Last modified: 24 October 2025

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 14%

Detection rules86th percentile · 86% of ATT&CK techniques have this many detection rules written or fewer.

Windows Remote Management MITRE reference T1021.006

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Storm-0501G1053 ↗

Has utilized the post-exploitation tool known as Evil-WinRM that uses PowerShell over Windows Remote Management (WinRM) for remote code execution.1

created 2025-10-191 reference

FIN13G1016 ↗

Has leveraged WMI to move laterally within a compromised network via application servers and SQL servers.1

created 2023-07-271 referenceaka Elephant Beetle

ChimeraG0114 ↗

Has used WinRM for lateral movement.1

created 2020-08-241 reference

Wizard SpiderG0102 ↗

Has used Window Remote Management to move laterally through a victim network.1

created 2020-05-121 referenceaka UNC1878

Threat Group-3390G0027 ↗

Has used WinRM to enable remote execution.1

created 2017-05-311 referenceaka Earth Smilodon

All 5 groups for this technique

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Brute Ratel C4S1063 ↗

Can use WinRM for pivoting.1

created 2023-02-07TOOL

SILENTTRINITYS0692 ↗

Tracks TrustedHosts and can move laterally to these targets via WinRM.1

created 2022-03-23TOOL

Cobalt StrikeS0154 ↗

Can use WinRM to execute a payload on a remote host.1 2

created 2017-12-14MALWAREcarried by 30 groups

All 3 software entries for this technique

Offense vs defense T1021.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 11Splunk ESCU (cumulative) · 9

first rule: 2019 Q2 · 2 of 2 campaigns plotted

Windows Remote Management detection strategy DET0477

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of WinRM-Based Remote Access

Enterprise

1 platform

AN1313 · Windows

Adversaries using WinRM to remotely execute commands, launch child processes, or access WMI. The detection chain includes service use, network activity, remote session logon, and process creation within a short temporal window.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Service MetadataDC0041	WinEventLog:WinRM	EventCode=6
Logon Session CreationDC0067	WinEventLog:Security	EventCode=4624, 4648
Network Traffic FlowDC0078	NSM:Connections	Inbound on ports 5985/5986

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines max time between remote shell creation and child process execution (e.g., 60 seconds)
UserContext	Scope to unexpected remote user logons (non-admins, service accounts)
CommandLineAnomalyScore	Score for suspicious command usage via WinRM (e.g., encoded PowerShell)
KnownAdminHosts	List of trusted systems allowed to use WinRM legitimately

3 analytics

Microsoft Windows uses its implementation of Distributed Computing Environment/Remote Procedure Call (DCE/RPC), which it calls Microsoft RPC, to call certain APIs remotely.

TypesTTP, Situational AwarenessCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTA	RPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	start	dest_port
flow	start	src_port

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Traffic to the RPC Endpoint Mapper will always have the destination port of 135. Assuming success, RPC traffic will continue to the endpoint. The endpoint and the client both bind to dynamically assigned ports (on Windows, this is typically greater than 49152). The traffic between the client and endpoint can be detected by looking at traffic to 135 followed by traffic where the source and destination ports are at least 49152.

flows = search Flow:Start
rpc_mapper = filter flows where (dest_port == 135)
rpc_endpoint = filter flows where (dest_port >= 49152 and src_port >= 49152)
rpc = join rpc_mapper, rpc_endpoint where (
 (rpc_mapper.time < rpc_endpoint.time < rpc_mapper.time + 2 seconds) and
 (rpc_mapper.src_ip == rpc_endpoint.src_ip and rpc_mapper.dest_ip == rpc_endpoint.dest_ip)
)
output rpc

According to ATT&CK, PowerShell can be used over WinRM to remotely run commands on a host. When a remote PowerShell session starts, svchost.exe executes wsmprovhost.exe

TypeTTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

process = search Process:Create
wsmprovhost = filter process where (exe == "wsmprovhost.exe" and parent_exe == "svchost.exe")

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "wsmprovhost.exe" and parent_process_name == "svchost.exe")

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="*\wsmprovhost.exe" parent_image="*\svchost.exe"

When a Windows Remote Management connection is opened, the client sends HTTP requests to port 5985 for HTTP or 5986 for HTTPS on the target host. Each HTTP(S) request to the URI "/wsman" is called, and other information is set in the headers. Depending on the operation, the HTTP method may vary (i.e., GET, POST, etc.). This analytic would detect Remote PowerShell, as well as other communications that rely on WinRM. Additionally, it outputs the executable on the client host, the connection information, and the hostname of the target host.

TypeSituational AwarenessCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-ANAA	Administrative Network Activity Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	start	dest_port

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Look for network connections to port 5985 and 5986. To really decipher what is going on, these outputs should be fed into something that can do packet analysis.

flow = search Flow:Start
winrm = filter flow where (dest_port == 5985)
winrm_s = filter flow where (dest_port == 5986)
output winrm, winrm_s

Tests3ExecutorsPowerShell 3Need elevation2 of 3Have prerequisites1Have cleanup1Platformswindows

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Enable Windows Remote Management windows PowerShell Required — —

Powershell Enable WinRM Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.

Attack command

Enable-PSRemoting -Force

GUIDe615545a-0b0b-44b4-ae8d-984b8329d46e

02 Remote Code Execution with PS Credentials Using Invoke-Command windows PowerShell — — Yes

Simulate lateral movement with PowerShell Remoting on the local host. Upon successful execution, PowerShell will execute whoami using Invoke-Command, targeting the local machine as remote target.

Attack command

Enable-PSRemoting -Force
Invoke-Command -ComputerName $env:COMPUTERNAME -ScriptBlock {whoami}

Cleanup command

Disable-PSRemoting -Force

GUID4f793fbe-d164-4fff-ba26-3b42d168fa10

03 WinRM Access with Evil-WinRM windows PowerShell Required 2 —

An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled

Input arguments

Name	Type	Default	Description
password	string	P@ssw0rd1	Password
user_name	string	Domain\Administrator	Username
destination_address	string	Target	Remote Host IP or Hostname

Attack command

evil-winrm -i #{destination_address} -u #{user_name} -p #{password}

Prerequisite

Computer must have Ruby Installed

Check

try {if (ruby -v) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest  -OutFile "PathToAtomicsFolder\..\ExternalPayloads\rubyinstaller-2.7.1-1-x64.exe" https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-2.7.1-1/rubyinstaller-2.7.1-1-x64.exe
$file1= "PathToAtomicsFolder\..\ExternalPayloads\rubyinstaller-2.7.1-1-x64.exe"
Start-Process $file1 /S;

Prerequisite

Computer must have Evil-WinRM installed

Check

try {if (evil-winrm -h) {exit 0} else {exit 1}} catch {exit 1}

Satisfy

gem install evil-winrm

GUIDea8cff46-3b62-4e15-a31d-d088b4e49790

Tests from Atomic Red Team (MIT licence) · technique definition

Windows Remote Management detections T1021.006

20 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 14%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs