WinRM Lateral Movement
Exploiting Windows Remote Management (WinRM) for lateral movement using tools like Evil-WinRM, CrackMapExec, and PowerShell remoting.
May 6, 2026
•
4 min read
WinRM:
Lateral Movement
Move across accounts or systems to expand reach. Use trust paths to access new assets.
1 guide
•
Created Dec 28, 2025
•
Updated Jul 13, 2026
WinRM lateral movement leverages PowerShell remoting to hop between hosts using harvested credentials or Kerberos tickets. Enter-PSSession gives you an interactive shell on the remote host, while Invoke-Command executes scripts across multiple targets simultaneously, making it one of the fastest lateral movement methods in a Windows domain.
Credential reuse is the primary vector. NTLM hashes work with Evil-WinRM's pass-the-hash support, and Kerberos tickets obtained through Rubeus or Mimikatz enable authentication without the plaintext password. When WinRM is allowed through the firewall between segments, it provides a clean lateral path that blends in with legitimate admin traffic.
The subpages cover remote session management, credential-based and ticket-based authentication for pivoting, JEA (Just Enough Administration) bypass techniques, and strategies for chaining WinRM sessions across multiple network segments.