kevmap

Techniques › T1021 › T1021.006

T1021.006 Windows Remote Management

lateral movement — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
11
Sigma rules tagged attack.t1021.006
0
KEV CVEs mapped here
<p>Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.</p><p>WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell. WinRM can be used as a method of remotely interacting with Windows Management Instrumentation.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1021.006

Remote PowerShell Session (PS Classic) lowtest
Author: Roberto Rodriguez @Cyb3rWard0g · 2019-08-10 (modified 2024-01-03) · logsource: product=windows category=ps_classic_start · 60167e5c-84b2-4c95-a7ac-86281f27c445
Detects remote PowerShell sessions
Techniques: T1059.001T1021.006
Remote PowerShell Session Host Process (WinRM) mediumtest
Author: Roberto Rodriguez @Cyb3rWard0g · 2019-09-12 (modified 2022-10-09) · logsource: product=windows category=process_creation · 734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8
Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).
Techniques: T1059.001T1021.006
Potential Lateral Movement via Windows Remote Shell mediumexperimental
Author: Liran Ravich · 2025-10-22 · logsource: product=windows category=process_creation · 79df3f68-dccb-48e9-9171-b75cbc37c51d
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.
Techniques: T1021.006
Execute Invoke-command on Remote Host mediumtest
Author: frack113 · 2022-01-07 · logsource: product=windows category=ps_script · 7b836d7f-179c-4ba4-90a7-a7e60afb48e6
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Techniques: T1021.006
Remote PowerShell Session (PS Module) hightest
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton · 2019-08-10 (modified 2023-01-20) · logsource: product=windows category=ps_module · 96b9f619-aa91-478f-bacb-c3e50f8df575
Detects remote PowerShell sessions
Techniques: T1059.001T1021.006
Enable Windows Remote Management mediumtest
Author: frack113 · 2022-01-07 · logsource: product=windows category=ps_script · 991a9744-f2f0-44f2-bd33-9092eba17dc3
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Techniques: T1021.006
HackTool - WinRM Access Via Evil-WinRM mediumtest
Author: frack113 · 2022-01-07 (modified 2023-02-13) · logsource: product=windows category=process_creation · a197e378-d31b-41c0-9635-cfdf1c1bb423
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Techniques: T1021.006
Remote LSASS Process Access Through Windows Remote Management highstable
Author: Patryk Prauze - ING Tech · 2019-05-20 (modified 2023-11-29) · logsource: product=windows category=process_access · aa35a627-33fb-4d04-a165-d33b4afca3e8
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.
Techniques: T1003.001T1059.001T1021.006
OMIGOD HTTP No Authentication RCE - CVE-2021-38647 highstable
Author: Nate Guagenti (neu5ron) · 2021-09-20 (modified 2025-11-03) · logsource: product=zeek service=http · ab6b1a39-a9ee-4ab4-b075-e83acf6e346b
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify, successful, exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Techniques: T1068T1190T1203T1021.006T1210
CVE tags: CVE-2021-38647
Winrs Local Command Execution highexperimental
Author: Liran Ravich, Nasreddine Bencherchali · 2025-10-22 · logsource: product=windows category=process_creation · bcfece3d-56fe-4545-9931-3b8e92927db1
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Techniques: T1021.006T1218
Potential Remote PowerShell Session Initiated hightest
Author: Roberto Rodriguez @Cyb3rWard0g · 2019-09-12 (modified 2024-02-02) · logsource: product=windows category=network_connection · c539afac-c12a-46ed-b1bd-5a5567c9f045
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.
Techniques: T1059.001T1021.006

Rules tagged at the parent level (attack.t1021) 11

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

OpenCanary - SMB File Open Request hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Techniques: T1021T1005
OpenCanary - FTP Login Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Techniques: T1190T1021
Psexec Execution mediumtest
Author: omkar72 · 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Techniques: T1569T1021
HackTool - NetExec Execution highexperimental
Author: Chirag Damani · 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d
Detects execution of the hacktool NetExec. NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems. Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Techniques: T1018T1021
Potential Remote Desktop Tunneling mediumtest
Author: Tim Rauch, Elastic (idea) · 2022-09-27 · logsource: product=windows category=process_creation · 8a3038e8-9c9d-46f8-b184-66234a160f6f
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Techniques: T1021
Privilege Escalation via Named Pipe Impersonation hightest
Author: Tim Rauch, Elastic (idea) · 2022-09-27 (modified 2022-12-30) · logsource: product=windows category=process_creation · 9bd04a79-dabe-4f1f-a5ff-92430265c96b
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Techniques: T1021
OpenCanary - VNC Connection Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · 9db5446c-b44a-4291-8b89-fcab5609c3b3
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Techniques: T1021
OpenCanary - SSH New Connection Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Techniques: T1133T1021T1078
OpenCanary - SNMP OID Request hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Techniques: T1016T1021
New RDP Connection Initiated From Domain Controller hightest
Author: Josh Nickels · 2024-05-10 · logsource: product=windows category=network_connection · fda34293-718e-4b36-b018-38caab0d1209
Detects an RDP connection originating from a domain controller.
Techniques: T1021
OpenCanary - SSH Login Attempt hightest
Author: Security Onion Solutions · 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
Techniques: T1133T1021T1078