MITRE ATT&CKsub-technique

T1021.006 Windows Remote Management

Published 2020-02-11 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Lateral Movement
Platforms
Windows
Version
1.2
Created
2020-02-11

Description

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1021 Remote Services technique

Tactic · MITRE ATT&CK (1)

  • TA0008 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1042 Disable or Remove Feature or Program mitigation
  • M1030 Network Segmentation mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (10)

  • G1053 Storm-0501 group
  • C0048 Operation MidnightEclipse campaign
  • G1016 FIN13 group
  • C0024 SolarWinds Compromise campaign
  • S1063 Brute Ratel C4 software (tool)
  • S0692 SILENTTRINITY software (tool)
  • G0114 Chimera group
  • G0102 Wizard Spider group
  • S0154 Cobalt Strike software (malware)
  • G0027 Threat Group-3390 group

Referenced by Compliance · mitigates (25)

  • CIS-12.2 Establish and Maintain a Secure Network Architecture CIS Safeguard v8.1
  • CIS-12.7 Ensure Remote Devices Utilize a VPN and are Connecting to an Enterprise's AAA Infrastructure CIS Safeguard v8.1
  • CIS-12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work CIS Safeguard v8.1
  • CIS-16.8 Separate Production and Non-Production Systems CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-46 Cross Domain Policy Enforcement NIST 800-53 control
  • NIST-SC-7 Boundary Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References