216.73.217.172

T1021.006: T1021.006

View on MITRE ATT&CK The MITRE Corporation · Published 11/02/2020 19:29 · Modified 27/03/2026 01:10

Essential information

MITRE technique ID
T1021.006
Confidence
100/100
Revoked
No
Published
11/02/2020 19:29
Modified
27/03/2026 01:10
Author / Source
The MITRE Corporation

Aliases

Windows Remote Management

Platforms

windows

Description

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)

Kill chain phases

Kill chainPhase
mitre-attack lateral-movement

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.