Windows Remote Management

Windows Remote Management (WinRM) is Microsoft’s implementation of the WS-Management (WS-Man) protocol — effectively PowerShell-over-HTTP(S) for remote host management. It listens on TCP 5985 (HTTP) or TCP 5986 (HTTPS) and is the transport behind PowerShell remoting (Enter-PSSession, Invoke-Command), the winrs.exe legacy client, CIM sessions (WSMan protocol option), and attacker tooling like evil-winrm. MITRE ATT&CK tracks its abuse as T1021.006 (Remote Services: Windows Remote Management).¹

WinRM is enabled by default only on server editions / domain controllers in many estates, but large organizations frequently enable PowerShell remoting fleet-wide to ease IT support — which is exactly why it is a high-value lateral-movement channel: the traffic is encrypted (5986) or at least expected, and authentication uses existing Kerberos/NTLM infrastructure.

UAC token filtering — the universal gate

By default, UAC restricts remote WinRM calls to domain admins and the built-in local “Administrator” account (RID 500). Other local administrator accounts receive a filtered token and are denied. This is the same restriction that applies to remote schtasks (see exploit-windows-scheduled-tasks) and remote service control (exploit-windows-services).

To allow other local admin accounts remote access, set LocalAccountTokenFilterPolicy to 1:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /t REG_DWORD /v LocalAccountTokenFilterPolicy /d 1

Enable-PSRemoting / winrm quickconfig set this key automatically on some configurations. Note the trade-off: disabling the filter also re-enables pass-the-hash with local accounts, which is why hardened environments leave it at 0 and use domain accounts instead.

Client interfaces

winrs.exe (legacy)

winrs.exe is the older built-in client for ad-hoc command execution over WinRM:

winrs.exe -u:$TARGET_USER `
          -p:$TARGET_PASSWORD `
          -r:$TARGET_HOST $COMMAND

The interface is largely deprecated in favor of PowerShell remoting and may not be present on recent Windows versions — but where it exists it is a LOLBin-grade exec primitive.²

PowerShell remoting

The modern path. Enter-PSSession gives an interactive shell; Invoke-Command fires script blocks at one or many hosts (fan-out is a single command away, which is what makes remoting so powerful for both admins and attackers):

# Build a PSCredential object
$SECURE_PASSWORD = ConvertTo-SecureString "$TARGET_PASSWORD" `
                                          -AsPlainText -Force
$CREDENTIAL_OBJECT = New-Object `
                   System.Management.Automation.PSCredential `
                   $TARGET_USER, $SECURE_PASSWORD
 
# Interactive session
Enter-PSSession -ComputerName $TARGET_HOST `
                -Credential $CREDENTIAL_OBJECT
 
# Non-interactive script block. Variables from the calling
# session are NOT in scope — pass them via -ArgumentList.
Invoke-Command -ComputerName $TARGET_HOST `
               -Credential $CREDENTIAL_OBJECT `
               -ScriptBlock { $POWERSHELL_SCRIPT }

Remoting sessions run under PowerShell’s logging stack — script block logging (EID 4104), module logging, and transcription all capture activity, unlike legacy wmic-style execution. See amsi-bypass for the defensive-scanning layer that also applies to remoting sessions.³

evil-winrm

The attacker-favorite third-party client: password, NTLM pass-the-hash, and certificate auth with built-in upload/download and in-memory PowerShell loaders. See evil-winrm.

Detection

• WinRM/Operational log — EID 91 (session creation), 168 (authentication success/failure detail)
• PowerShell EID 4103/4104 — command and script-block content executed through remoting
• Network — unexpected 5985/5986 connections, especially workstation-to-workstation (remoting should mostly flow from jump boxes)
• MITRE mitigation M1042: disable the WinRM service where remoting is not required

Sources

• Remote Services: Windows Remote Management
• Installation and configuration for Windows Remote Management
• How to configure WINRM for HTTPS
• 2015 — Understanding and troubleshooting WinRM connection and authentication: a thrill seeker’s guide to adventure

Related: evil-winrm, seimpersonate-token-abuse, wmi-remote-service-execution, exploit-windows-services, exploit-windows-scheduled-tasks, dcerpc

Footnotes

1. Remote Services: Windows Remote Management ↩

2. 2015 — Understanding and troubleshooting WinRM connection and authentication: a thrill seeker’s guide to adventure ↩

3. Installation and configuration for Windows Remote Management ↩