1. Home
  2. ATT&CK Techniques
  3. T1021.006 Windows Remote Management

T1021.006 Windows Remote Management Mappings

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the winrm command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014)

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name
AC-17 Remote Access Protects T1021.006 Windows Remote Management
AC-2 Account Management Protects T1021.006 Windows Remote Management
AC-3 Access Enforcement Protects T1021.006 Windows Remote Management
AC-4 Information Flow Enforcement Protects T1021.006 Windows Remote Management
AC-5 Separation of Duties Protects T1021.006 Windows Remote Management
AC-6 Least Privilege Protects T1021.006 Windows Remote Management
CM-2 Baseline Configuration Protects T1021.006 Windows Remote Management
CM-5 Access Restrictions for Change Protects T1021.006 Windows Remote Management
CM-6 Configuration Settings Protects T1021.006 Windows Remote Management
CM-7 Least Functionality Protects T1021.006 Windows Remote Management
CM-8 System Component Inventory Protects T1021.006 Windows Remote Management
IA-2 Identification and Authentication (organizational Users) Protects T1021.006 Windows Remote Management
RA-5 Vulnerability Monitoring and Scanning Protects T1021.006 Windows Remote Management
SC-46 Cross Domain Policy Enforcement Protects T1021.006 Windows Remote Management
SC-7 Boundary Protection Protects T1021.006 Windows Remote Management
SI-4 System Monitoring Protects T1021.006 Windows Remote Management
network_security_groups Network Security Groups technique_scores T1021.006 Windows Remote Management
azure_network_traffic_analytics Azure Network Traffic Analytics technique_scores T1021.006 Windows Remote Management