T1021.006Lateral Movement

Windows Remote Management

Lateral movement via WinRM/PSRemoting.

§ Where this technique fits

T1021.006 is catalogued under the Lateral Movement tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 4 on average.

Authoritative reference: attack.mitre.org/techniques/T1021/006/.

§ Dossiers chaining this technique

LAPS read → local admin on every endpoint
A delegated 'helpdesk' group gains read access to ms-Mcs-AdmPwd. Compromising any member of that group cascades to local admin on every LAPS-managed machine.
step 4 / 5

§ What commonly comes next

01
LSASS Memory
T1003.001 · Credential Access
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

LAPS read → local admin on every endpoint

§ What commonly comes next