Windows Remote Execution: The Techniques Attackers Use to Move Laterally

Lateral movement in a Windows environment rarely involves an exploit. An attacker with valid credentials uses the same remote execution mechanisms administrators use, which is why it looks like legitimate activity and why detection has to be based on pattern rather than on the mechanism itself.

How the credentials are obtained is covered under pass-the-hash; this is what is done with them.

Service creation

The oldest and most reliable. Connect to the target's administrative share, copy an executable, create a service pointing at it remotely, start the service, then delete it afterwards. The service runs as SYSTEM.

It is noisy by modern standards, and it still works everywhere, which is why it remains common. The detection is straightforward: event 7045 records a service installation, and a service created remotely with a random or short name, running from a temporary path, and removed minutes later is not an administrator doing maintenance.

WMI

Windows Management Instrumentation provides remote process creation as a built-in management capability. No file needs to be copied if the command is self-contained, and nothing is installed.

It is quieter than service creation and heavily used by legitimate management tooling, which is what makes it attractive. The signal is the process lineage: a process whose parent is the WMI provider host is executing something invoked remotely, and on a workstation that is rare.

WMI event subscriptions are the persistence variant, triggering code on system events and surviving reboot without any autostart entry — one of the mechanisms under persistence techniques and among the least frequently audited.

WinRM and remote PowerShell

The modern, sanctioned remote management path, which is precisely its appeal — the traffic is expected in environments that use it for administration.

The advantage for defenders is that it logs well. Script block logging records what was executed even when obfuscated, module logging records the commands, and transcription captures the session. These are off by default and are the single most valuable Windows logging change most organizations can make.

Without them, remote PowerShell is close to invisible. With them, it is one of the better-instrumented execution paths available.

Scheduled tasks and DCOM

A task can be created remotely to run a command, either immediately or on a trigger, providing both execution and persistence in one step. Event 4698 records task creation, and remote creation of a task that runs once and is deleted is a strong indicator.

DCOM offers several objects exposing methods that ultimately execute a command, and they are obscure enough that many detections do not cover them. The parent process is the tell — execution descending from a DCOM host process is unusual.

What to watch, in practice

Individual events are weak signals; the combination is strong.

Authentication patterns first. Workstation-to-workstation logons, an account authenticating to a system it has never touched, and administrative logons from unexpected sources. Event 4624 with logon type 3 (network) records these, and it is where the fan-out described under flow data also appears.

Administrative share access. Legitimate use exists and is patterned; access to C$ or ADMIN$ from a workstation is not.

Execution events with unusual parentage — the WMI provider, the service control manager, the WinRM host, a DCOM host — particularly on endpoints rather than servers.

Sequence. Network logon, then administrative share access, then service or task creation, then execution, within seconds, is the signature. Correlating that chain in your SIEM produces far fewer false positives than alerting on any one step.

Reducing what is possible

Block workstation-to-workstation traffic. Host firewall rules preventing peers reaching each other on SMB and remote management ports remove most lateral movement paths at once, and legitimate need is rare.

Unique local administrator passwords per machine, so credentials from one host do not work on the next — the single most effective control here.

Administrative tiering, so privileged credentials never land on a workstation to be stolen, as under privileged access management.

Restrict remote management to designated administrative hosts rather than permitting it from anywhere.

Enable the logging that makes the rest visible: script block logging, command-line auditing in process creation events, and service and task creation auditing. Detection here is almost entirely a function of whether these were turned on before the incident.

Exam angles

Know remote service creation, WMI process creation, WinRM and remote PowerShell, scheduled tasks and DCOM as Windows lateral movement techniques using valid credentials rather than exploits. Know event 7045 for service installation, 4698 for scheduled task creation and 4624 type 3 for network logon. Recognize that detection depends on sequence and process lineage rather than on any single event, and name host firewalls blocking peer traffic, unique local administrator passwords and administrative tiering as the structural controls.