> For the complete documentation index, see [llms.txt](https://dmcxblue.gitbook.io/red-team-notes-2-0/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/lateral-movement/t1021-remote-services/windows-remote-management.md).

# Windows Remote Management

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system(e.g., run an executable, modify the Registry, modify services). It may be called with the winrm command or by any number of programs such as PowerShell.

**Example**

Here we have a technique that will allow us to lateral move onto a different machine using he WinRM service, this can be easily taken advantage with the use of PowerShell

We can verify if this is available on our target with the **Test-WsMan** Cmdlet

![](/files/-MRl2jREvqJTfXE8Uqe_)

**Usually Administrators can log in to a workstation where they have administrator privileges or sometimes we can find users that have this privileges as well.**

![](/files/-MRl2in4F-7Lumxs7dRZ)

Now will remote onto the target machine, assuming  we have credentials

![](/files/-MRl2kNY9DbGun_fata0)

And Login successfully

![](/files/-MRl2lHcACETfdaTLd2W)