Cross-source coverage
T1028 / ATT&CK
Windows Remote Management
ATT&CK has retired this technique. Rules still tag it; the current id is T1021.006 Remote Services: Windows Remote Management.
2 rules across 1 source.
4 deprecated hidden · include
From MITRE ATT&CK 19.2
Windows Remote Management (WinRM) is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.
- Tactics
- Execution · Lateral Movement
- Platforms
- Windows
- Telemetry
- —
Emerging Threats Open
2 rules| Detection | Severity | Format |
|---|---|---|
| ET POLICY WinRM wsman Access - Possible Lateral Movement | High | Suricata |
| ET USER_AGENTS WinRM User Agent Detected - Possible Lateral Movement | Medium | Suricata |