Enable Windows Remote Management

SigmaHQ Detections@sigmaHQ

•updated Sep 3, 2026•1•0•6

Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.