High severityNIST SP 800-6137 steps · 6 phases

Lateral Movement Response: SMB/PsExec, WMI, and WinRM

Covers source identification, containment, and artifact cleanup steps for lateral movement incidents carried out by an attacker via PsExec/SMB, WMI, or WinRM; complements the T1053.005 playbook.

Updated: June 13, 2026

Information note

Informational note: Lateral movement over SMB, WMI, and WinRM leaves different artifacts per channel: WMI remote execution leaves a trace as a wmiprvse.exe child process on the target system and in the Microsoft-Windows-WMIActivity/Operational log, while WinRM authentication events appear in the Security log. Egress filtering is mandatory to prevent LOLBAS techniques from reaching outside the network.

Prepare

5 steps

Enable SMB service auditing
The `auditpol /get /subcategory:"Detailed File Share"` output must show "Success" enabled; required for EID 5140 (share access) and EID 7045 (service installation)
Verify WMI-Activity/Operational log
Confirm the log is enabled using `wevtutil gl Microsoft-Windows-WMI-Activity/Operational`; enabled by default on Server 2012 R2 and later
Verify WinRM Operational log
Confirm the log is enabled using `wevtutil gl Microsoft-Windows-WinRM/Operational`; provides connection source information via EID 91/168
Check LAPS deployment and ADMIN$ share status
Verify ADMIN$ is active using `net share`; if LAPS is not deployed, do so as P0; prevents lateral movement across the fleet using the same local admin password
Verify PowerShell Script Block Logging is enabled
Check via GPO that the `Turn on PowerShell Script Block Logging` policy is enabled; EID 4104 records commands executed through the WinRM channel

Detect & Analyze

9 steps

Lateral Movement Response: SMB/PsExec, WMI, and WinRM

Prepare

Detect & Analyze

Contain

Eradicate

Recover

Post-Incident