PowerShell WinRM Lateral Movement via PSRemoting Cmdlets - T1021.006

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects the execution of PowerShell commands used to initiate remote sessions (e.g., New-PSSession, Invoke-Command) targeting specific remote hosts, excluding localhost connections and common system processes. This behavior is often associated with lateral movement or remote administration activities.