Use valid administrative credentials to access Windows SMB administrative shares and the remote Service Control Manager, then launch a process on the target. This record covers authenticated SMB remote access and execution (ATT&CK T1021.002); share discovery (T1135), DCOM, and WinRM are separate behaviors.
Variant:
Run a Windows command over WinRM
powershell
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER
RESTRICTED_ACCESS_BLUR_MARKER