自动化接入 · API / MCP EN

技术说明 · T1021.006

Windows Remote Management

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.

ATT&CK T1021.006 platforms — 状态 有效 版本 20.1

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).1 It may be called with the `winrm` command or by any number of programs such as PowerShell.2 WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.3

  1. Microsoft WinRM
  2. Jacobsen 2014
  3. MSDN WMI

使用该技术的组织

组织名称国家
grp_g0114ChimeraChina
grp_g0102Wizard SpiderRussia
grp_g1053Storm-0501—
grp_g1016FIN13—
grp_g0027Threat Group-3390China

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。