Windows Remote Management
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as Po...
BY SOURCE
PROCEDURES (13)
Auto-extracted: 4 detections for lateral
Auto-extracted: 3 detections for script block
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for child process
Auto-extracted: 2 detections for script execution monitoring
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for lateral