Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (e.g., run an executable, modify the Registry, modify services).(Citation: Microsoft WinRM) It may be called with the `winrm` command or by any number of programs such as PowerShell.(Citation: Jacobsen 2014) WinRM  can be used as a method of remotely interacting with [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047).(Citation: MSDN WMI)
Windows Remote Management
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1021/006  external_id: T1021.006     source_name: Medium Detecting Lateral Movement  description: French, D. (2018, September 30). Detecting Lateral Movement Using Sysmon and Splunk. Retrieved October 11, 2019.  url: https://medium.com/threatpunter/detecting-lateral-movement-using-sysmon-and-splunk-318d3be141bc     source_name: Jacobsen 2014  description: Jacobsen, K. (2014, May 16). Lateral Movement with PowerShell&#91;slides&#93;. Retrieved November 12, 2014.  url: https://www.slideshare.net/kieranjacobsen/lateral-movement-with-power-shell-2     source_name: MSDN WMI  description: Microsoft. (n.d.). Windows Management Instrumentation. Retrieved April 27, 2016.  url: https://msdn.microsoft.com/en-us/library/aa394582.aspx     source_name: Microsoft WinRM  description: Microsoft. (n.d.). Windows Remote Management. Retrieved November 12, 2014.  url: http://msdn.microsoft.com/en-us/library/aa384426     