Windows Remote Management

Adversaries may use valid accounts to interact with remote Windows systems through Windows Remote Management (WinRM) and perform actions as the authenticated user. WinRM is both a Windows service and the WS-Management protocol; Windows PowerShell remoting uses it, and remote actions are limited by account and session-endpoint permissions. The four examples below are independent alternatives, not a required sequence. An Internet-originating variant is possible only when the target listener and intervening network policy permit external reachability; a default port alone does not establish Internet exposure.