T1021.006 — Windows Remote Management

Tactic: Lateral Movement · Platforms: Windows

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an…

Sub-technique of Remote Services (T1021).

Sigma detection rules (1)

T1021.006 Remote Services: Windows Remote Management

title: "T1021.006 Remote Services: Windows Remote Management"
id: fcf33ecc-7a7a-478e-9d20-3ca2d27c8ba3
description: 'Behavioral Detection of WinRM-Based Remote Access. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, CommandLineAnomalyScore, KnownAdminHosts.'
references:
  - https://attack.mitre.org/techniques/T1021/006
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.006

logsource:
  category: process_creation
  product: windows

detection:
  selection_host:
    Image|endswith: '\wsmprovhost.exe'

  selection_child:
    ParentImage|endswith: '\wsmprovhost.exe'

  condition: 1 of selection_*

falsepositives:
  - Legitimate remote administration via WinRM/PowerShell Remoting (DSC, Ansible, SCCM).

level: medium

Related sub-techniques

Explore