T1021.006: Windows Remote Management
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).[1] It may be called with the `winrm` command or by any number of programs such as PowerShell.[2] WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.[3]
Analyst context for executives and security teams
Windows Remote Management matters because it turns valid Windows credentials into remote operational control. If an adversary has an account that can use WinRM, they may run commands, change Registry settings, modify services, or interact with WMI on another Windows system as that user. For leaders, this is less about a “malware signature” and more about whether remote administration, privileged access, and lateral movement are governed and evidenced well enough to withstand an incident or audit.
Executive priority
Treat WinRM as a business-continuity and identity-control issue. It is a legitimate administration capability, so blocking every use may be unrealistic; the priority is proving who can use it, from where, against which systems, and with what logging. ATT&CK maps this technique to lateral movement and notes use by multiple campaigns, groups, and post-exploitation tools, which makes it a practical control-validation area for incident readiness, managed detection, privileged access reviews, segmentation decisions, and compliance evidence around administrative activity.
Technical view
Validate coverage on Windows systems where WinRM is enabled or administratively required. Because MITRE provides no technique-specific detection text for this object, detection engineering should be behavior-driven and aligned to the related detection strategy DET0477: identify WinRM-based remote access patterns, then distinguish expected administration from unusual account, host, timing, or remote-action combinations. SOC and IR teams should correlate Valid Accounts-style authentication, PowerShell or winrm invocation, remote process execution, Registry or service modification, and WMI interaction where available. The parent technique is Remote Services, so analysis should also consider whether WinRM activity is part of broader lateral movement across Windows hosts.
Likely telemetry
- Windows authentication and logon events showing remote use of accounts
- WinRM service activity and configuration state on Windows endpoints and servers
- PowerShell execution and script/activity logs where PowerShell is used to call WinRM
- Process creation telemetry for winrm, PowerShell, or related remote administration programs
- Windows Management Instrumentation activity when WinRM is used to interact with WMI
Detection direction
- Baseline approved WinRM administration paths: expected admin accounts, source systems, destination systems, and maintenance windows.
- Alert on WinRM activity involving accounts, hosts, or peer-to-peer paths that are not part of the approved administrative model.
- Correlate remote logon, WinRM/PowerShell execution, and follow-on changes to services, Registry, or WMI rather than relying on a single event type.
- Tune for false positives from legitimate systems management and helpdesk activity; require context such as account privilege, source host role, and destination criticality.
- Use relationship context from Cobalt Strike, SILENTTRINITY, and Brute Ratel C4 mappings to ensure detections focus on behavior, not only known tool names.
Mitigation priorities
- Start with privileged account management: enforce least privilege, restrict which accounts can use WinRM, and require accountability through logging and auditing.
- Segment administrative access paths so WinRM is not broadly reachable across Windows environments without business need.
- Disable or remove WinRM where it is unnecessary, especially on systems that do not require remote management through this service or protocol.
- Maintain an approved remote administration model that defines allowed users, source hosts, destination groups, and change-control expectations.
- Use periodic access reviews and incident-response exercises to confirm that WinRM misuse can be identified, scoped, and contained quickly.
Analyst notes and limits
This object is a Windows sub-technique of Remote Services under lateral movement. The key defensive issue is legitimate remote administration abuse through valid accounts, not the mere presence of WinRM. ATT&CK relationship context shows this behavior is relevant across named campaigns, groups, and post-exploitation tools, but local risk depends on whether WinRM is enabled, who can use it, and what telemetry is retained.
MITRE does not provide official detection text for this technique in the supplied object. The take therefore uses the official description, external references, and supplied relationships only. It does not assert current exploitation, customer exposure, or guaranteed detection coverage; those require environment-specific validation.
Windows Remote Management
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).[1] It may be called with the `winrm` command or by any number of programs such as PowerShell.[2] WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.[3]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1021 | Remote Services | This object subtechnique of Remote Services. |
| Enterprise | T1028 | Windows Remote Management | Windows Remote Management revoked by this object. |
Groups, software, and campaigns
G1016: FIN13
G0114: Chimera
G1053: Storm-0501
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.[1][2][3][4]
G0027: Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
G0102: Wizard Spider
Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.[1][2][3]
S1063: Brute Ratel C4
Brute Ratel C4 is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. Brute Ratel C4 was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities, and deploys agents called badgers to enable arbitrary command execution for lateral movement, privilege escalation, and persistence. In September 2022, a cracked version of Brute Ratel C4 was leaked in the cybercriminal underground, leading to its use by threat actors.[1][2][3][4][5]
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
C0024: SolarWinds Compromise
The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. APT29 used customized malware to inject malicious code into the SolarWinds Orion software build process that was later distributed through a normal software update; they also used password spraying, token theft, API abuse, spear phishing, and other supply chain attacks to compromise user accounts and leverage their associated access. Victims of this campaign included government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East. This activity has been labled the StellarParticle campaign in industry reporting.[1] Industry reporting also initially referred to the actors involved in this campaign as UNC2452, NOBELIUM, Dark Halo, and SolarStorm.[2][3][4][5][1][6][7][8]
In April 2021, the US and UK governments attributed the SolarWinds Compromise to Russia's Foreign Intelligence Service (SVR); public statements included citations to APT29, Cozy Bear, and The Dukes.[9][10][11] The US government assessed that of the approximately 18,000 affected public and private sector customers of Solar Winds’ Orion product, a much smaller number were compromised by follow-on APT29 activity on their systems.[12]
C0048: Operation MidnightEclipse
Operation MidnightEclipse was a campaign conducted in March and April 2024 that involved initial exploit of zero-day vulnerability CVE-2024-3400, a critical command injection vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 47abd11e8379… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Microsoft WinRM
Microsoft. (n.d.). Windows Remote Management. Retrieved September 12, 2024.
Open source URL -
[2]
Jacobsen 2014
Jacobsen, K. (2014, May 16). Lateral Movement with PowerShell[slides]. Retrieved November 12, 2014.
Open source URL -
[3]
MSDN WMI
Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016.
Open source URL -
[4]
Medium Detecting Lateral Movement
French, D. (2018, September 30). Detecting Lateral Movement Using Sysmon and Splunk. Retrieved October 11, 2019.
Open source URL -
[5]
mitre-attack T1021.006Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.