The Art of Lateral Movement: Windows Management Instrumentation (WMI) and WinRM

Wylie Bayes

• 2 min read

When a Red Team achieves a foothold on a corporate workstation, the ultimate prize—the Domain Controller, the customer database, or the financial SWIFT terminal—is rarely sitting on the same machine. To reach their objective, the attacker must traverse the network. This phase of the attack lifecycle is called Lateral Movement.

For decades, the undisputed king of lateral movement was PsExec. By abusing the Server Message Block (SMB) protocol, attackers could easily spawn remote shells. However, PsExec is incredibly noisy. It drops a visible binary on the target disk, creates and starts a new Windows service, and generates massive, highly-signatured event logs. Modern EDRs will catch PsExec instantly.

To move quietly, modern adversaries rely on native management protocols that are already humming in the background of every enterprise network: WMI and WinRM.

Windows Management Instrumentation (WMI)

WMI is Microsoft’s implementation of the Web-Based Enterprise Management (WBEM) standard. It is a deeply integrated administrative framework that allows IT staff to query system information, start services, and execute commands across fleets of Windows machines.

Because WMI traffic operates over Remote Procedure Calls (RPC) on Port 135 and dynamic high ports, it is almost never blocked internally, as doing so would break legitimate administration tools (like SCCM).

Abusing WMI for Lateral Movement

If an attacker compromises an account with local administrator rights on a remote target, they can use WMI to remotely spawn a process completely filelessly.

Using PowerShell, an attacker can invoke the Win32_Process class to create a new process on a remote server:

Invoke-WmiMethod -ComputerName "Target-Server" -Class Win32_Process -Name Create -ArgumentList "powershell.exe -enc <Base64_Payload>"

Why is this stealthy?

  1. No New Services: Unlike PsExec, WMI does not create a new Windows service.
  2. Parent-Child Obfuscation: The malicious process (powershell.exe) is spawned as a child of WmiPrvSE.exe (the WMI Provider Host). This is a completely legitimate and common parent-child relationship in enterprise environments, making it difficult for Blue Teams to spot the anomaly.

Windows Remote Management (WinRM)

WinRM is Microsoft’s newer, more modern remote management protocol. It is the backend engine that powers PowerShell Remoting. Unlike WMI, which uses highly dynamic RPC ports, WinRM communicates over HTTP (Port 5985) or HTTPS (Port 5986).

WinRM is enabled by default on Windows Server operating systems, making it a highly attractive vector for lateral movement.

Abusing WinRM via PowerShell Remoting

If an attacker has the correct credentials, they can establish a remote, interactive shell that feels almost exactly like an SSH session on Linux.

Enter-PSSession -ComputerName "Target-Server" -Credential $creds

Alternatively, they can execute commands asynchronously across dozens of machines at once using Invoke-Command.

Why is this stealthy?
WinRM traffic is encrypted by default (even over HTTP port 5985, as the underlying NTLM/Kerberos authentication encapsulates the payload). This prevents network-level Intrusion Detection Systems (IDS) from reading the commands being executed on the wire. Furthermore, to the network firewall, it simply looks like standard administrative HTTP traffic.

Defending Against Native Protocol Abuse

Because WMI and WinRM are legitimate tools, you cannot simply uninstall them. Defense requires granular visibility and access control.

  1. Monitor Process Creation: Blue Teams must enable Event ID 4688 (Process Creation) with Command Line Auditing enabled. If WmiPrvSE.exe spawns a command shell or PowerShell executing a massive base64 string, an alert should fire immediately.
  2. Enforce Just Enough Administration (JEA): Restrict WinRM access. Instead of granting administrators full access to remote machines, JEA allows you to lock down PowerShell remoting endpoints so that users can only run a highly specific whitelist of commands.
  3. Network Segmentation: Workstations rarely need to execute WMI commands against other workstations. Host-based firewalls should be configured to block inbound RPC and WinRM traffic from standard user subnets, only allowing it from dedicated jump hosts or administrative VLANs.

Conclusion

Lateral movement has evolved from loud, disk-based service creation to stealthy, memory-resident API calls. By mastering WMI and WinRM, Red Teams can navigate a domain undetected, blending seamlessly into the daily hum of enterprise administration.