Automation · API / MCP 中文

Technique note · T1028

Windows Remote Management

Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the <code>winrm</code> command or by any number of programs such as PowerShell.

ATT&CK T1028 platforms — Status Active Version 20.1

Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). 1 It may be called with the <code>winrm</code> command or by any number of programs such as PowerShell. 2

  1. Microsoft WinRM
  2. Jacobsen 2014

Groups using this technique

No group use in the reference set yet.

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.