{"id":"T1021.006","name":"Windows Remote Management","url":"https://attack.mitre.org/techniques/T1021/006","tactics":["lateral-movement"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0477","stix_id":"x-mitre-detection-strategy--7ff1f384-2373-4ea9-9311-1587b520a5c4","name":"Behavioral Detection of WinRM-Based Remote Access","url":"https://attack.mitre.org/detectionstrategies/DET0477","analytics":[{"id":"AN1313","stix_id":"x-mitre-analytic--9dab17bf-62c7-4187-90f4-7335790df7c0","name":"Analytic 1313","description":"Adversaries using WinRM to remotely execute commands, launch child processes, or access WMI. The detection chain includes service use, network activity, remote session logon, and process creation within a short temporal window.","url":"https://attack.mitre.org/detectionstrategies/DET0477#AN1313","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:WinRM","channel":"EventCode=6","data_component":"DC0041","data_component_name":"Service Metadata","log_source_slug":"wineventlog-winrm"},{"name":"NSM:Connections","channel":"Inbound on ports 5985/5986","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-connections"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines max time between remote shell creation and child process execution (e.g., 60 seconds)"},{"field":"UserContext","description":"Scope to unexpected remote user logons (non-admins, service accounts)"},{"field":"CommandLineAnomalyScore","description":"Score for suspicious command usage via WinRM (e.g., encoded PowerShell)"},{"field":"KnownAdminHosts","description":"List of trusted systems allowed to use WinRM legitimately"}],"live":true,"detection_strategies":["DET0477"],"techniques":["T1021.006"]}],"live":true,"version":"1.0","techniques":["T1021.006"]}],"sigma_rules":[{"id":"60167e5c-84b2-4c95-a7ac-86281f27c445","title":"Remote PowerShell Session (PS Classic)","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"low","date":"2019-08-10","modified":"2024-01-03","description":"Detects remote PowerShell sessions","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8","title":"Remote PowerShell Session Host Process (WinRM)","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2019-09-12","modified":"2022-10-09","description":"Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.t1059.001","attack.t1021.006"],"path":"rules/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"79df3f68-dccb-48e9-9171-b75cbc37c51d","title":"Potential Lateral Movement via Windows Remote Shell","author":"Liran Ravich","status":"experimental","level":"medium","date":"2025-10-22","modified":null,"description":"Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.\n","references":["https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/","https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/process_creation/proc_creation_win_winrshost_command_execution.yml","techniques":["T1021.006"],"cves":[]},{"id":"7b836d7f-179c-4ba4-90a7-a7e60afb48e6","title":"Execute Invoke-command on Remote Host","author":"frack113","status":"test","level":"medium","date":"2022-01-07","modified":null,"description":"Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-2---invoke-command","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.4"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml","techniques":["T1021.006"],"cves":[]},{"id":"96b9f619-aa91-478f-bacb-c3e50f8df575","title":"Remote PowerShell Session (PS Module)","author":"Roberto Rodriguez @Cyb3rWard0g, Tim Shelton","status":"test","level":"high","date":"2019-08-10","modified":"2023-01-20","description":"Detects remote PowerShell sessions","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"991a9744-f2f0-44f2-bd33-9092eba17dc3","title":"Enable Windows Remote Management","author":"frack113","status":"test","level":"medium","date":"2022-01-07","modified":null,"description":"Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml","techniques":["T1021.006"],"cves":[]},{"id":"a197e378-d31b-41c0-9635-cfdf1c1bb423","title":"HackTool - WinRM Access Via Evil-WinRM","author":"frack113","status":"test","level":"medium","date":"2022-01-07","modified":"2023-02-13","description":"Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm","https://github.com/Hackplayers/evil-winrm"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml","techniques":["T1021.006"],"cves":[]},{"id":"aa35a627-33fb-4d04-a165-d33b4afca3e8","title":"Remote LSASS Process Access Through Windows Remote Management","author":"Patryk Prauze - ING Tech","status":"stable","level":"high","date":"2019-05-20","modified":"2023-11-29","description":"Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.","references":["https://pentestlab.blog/2018/05/15/lateral-movement-winrm/"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.credential-access","attack.execution","attack.t1003.001","attack.t1059.001","attack.lateral-movement","attack.t1021.006","attack.s0002"],"path":"rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml","techniques":["T1003.001","T1059.001","T1021.006"],"cves":[]},{"id":"ab6b1a39-a9ee-4ab4-b075-e83acf6e346b","title":"OMIGOD HTTP No Authentication RCE - CVE-2021-38647","author":"Nate Guagenti (neu5ron)","status":"stable","level":"high","date":"2021-09-20","modified":"2025-11-03","description":"Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request.\nVerify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP).\nWithin the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.\n","references":["https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure","https://twitter.com/neu5ron/status/1438987292971053057?s=20"],"logsource":{"product":"zeek","service":"http"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.lateral-movement","attack.t1068","attack.t1190","attack.t1203","attack.t1021.006","attack.t1210","detection.emerging-threats","cve.2021-38647"],"path":"rules-emerging-threats/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml","techniques":["T1068","T1190","T1203","T1021.006","T1210"],"cves":["CVE-2021-38647"]},{"id":"bcfece3d-56fe-4545-9931-3b8e92927db1","title":"Winrs Local Command Execution","author":"Liran Ravich, Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-10-22","modified":null,"description":"Detects the execution of Winrs.exe where it is used to execute commands locally.\nCommands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.\n","references":["https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.stealth","attack.t1021.006","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml","techniques":["T1021.006","T1218"],"cves":[]},{"id":"c539afac-c12a-46ed-b1bd-5a5567c9f045","title":"Potential Remote PowerShell Session Initiated","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-09-12","modified":"2024-02-02","description":"Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.\nThis could potentially indicates a remote PowerShell connection.\n","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml","techniques":["T1059.001","T1021.006"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}