Windows Remote Management
Subtechnique · ATTACK:enterprise:T1021.006
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1021.006",
"title": "Windows Remote Management",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1021/006",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65",
"external_id": "T1021.006",
"domain": "enterprise",
"created": "2020-02-11T18:29:47.757Z",
"modified": "2025-10-24T17:48:51.000Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "Medium Detecting Lateral Movement",
"url": "https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc"
},
{
"source_name": "Jacobsen 2014",
"url": "https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2"
},
{
"source_name": "MSDN WMI",
"url": "https://msdn.microsoft.com/en-us/library/aa394582.aspx"
},
{
"source_name": "Microsoft WinRM",
"url": "https://learn.microsoft.com/en-us/windows/win32/winrm/portal"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f9b73b7-734d-4ceb-8a93-776652626c73
Sygnia Elephant Beetle Jan 2022ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1677745c-06d5-4791-be9c-1104549c34b2
ATTACK:enterprise:T1021.006 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22e8b7b4-7e5f-45a8-a935-c4cc7da638f2
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--335d97be-914a-4198-aa06-55095e850ffc
ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c40e9a1-72fd-4c7d-8a69-df574c54441e
Palo Alto Brute Ratel July 2022ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--571c83a5-0a53-4f57-93bc-52356b6cc741
NCC Group Chimera January 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64642489-4a11-48e3-a31e-b3cee75bd7be
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7779c4b8-d007-439a-81b7-b56efb8742ea
Symantec RAINDROP January 2021ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5bab3a0-69b6-4ef6-97b3-3f3aecd710f8
cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cade04ba-4229-4655-9fe9-9e2d9b44536c
Volexity UPSTYLE 2024ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb57c953-1aab-4706-8947-545d4cb0cdce
NSA SpottingATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db1f0baf-27ee-4e1c-9d8f-6a82918b5f0f
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df8350d6-a7a7-421d-a9e8-64d7e0cc0653
SecureWorks BRONZE UNION June 2017ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f947ae1c-1042-469d-b00e-84784e406cec
DHS/CISA Ransomware Targeting Healthcare October 2020