T1021.006sub-technique of T1021 Remote Services
Windows Remote Management
Windowsnothing on this site yetT1021.006 on attack.mitre.org
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the `winrm` command or by any number of programs such as PowerShell.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
how MITRE says to see it
Behavioral Detection of WinRM-Based Remote Access
- Adversaries using WinRM to remotely execute commands, launch child processes, or access WMI. The detection chain includes service use, network activity, remote session logon, and process creation within a short temporal window.
what reduces it
- M1030 Network Segmentation. If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices.
- M1026 Privileged Account Management. If the service is necessary, lock down critical enclaves with separate WinRM accounts and permissions.
- M1042 Disable or Remove Feature or Program. Disable the WinRM service.