Automation · API / MCP 中文

Technique note · T1021.006

Windows Remote Management

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.

ATT&CK T1021.006 platforms — Status Active Version 20.1

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).1 It may be called with the `winrm` command or by any number of programs such as PowerShell.2 WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.3

  1. Microsoft WinRM
  2. Jacobsen 2014
  3. MSDN WMI

Groups using this technique

GroupNameCountry
grp_g0114ChimeraChina
grp_g0102Wizard SpiderRussia
grp_g1053Storm-0501—
grp_g1016FIN13—
grp_g0027Threat Group-3390China

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.