Remote Services Execution

Authenticated lateral movement by executing commands on a Windows host through SMB-based service execution (NetExec or Impacket) or WMI over DCOM (Impacket). The listed methods are alternatives, not sequential steps, and require valid credentials plus the rights, shares, and network access for the selected method. The SMB variant is usable from the Internet only when the target's TCP 445 service is Internet-reachable and authorized credentials are available. The WMI/DCOM variant requires reachable RPC/DCOM endpoints and, with Impacket's default output mode, an SMB share for retrieving command output. This record covers SMB and WMI/DCOM execution; it does not cover RDP, WinRM, or service discovery.