Skip to content

04 · Remote administration and lateral-movement reasoning

Depth: developed lesson · Prerequisites: Windows and AD, Kerberos, network diagnosis · Time: two 90-minute sessions plus optional native lab validation.

A remote session is the end of a chain of prerequisites. A listening service, an identity accepted by an authentication mechanism, permission to invoke an endpoint, and the context used for execution are separate facts. This chapter teaches how to establish that chain and how to avoid turning one successful probe into a claim of unrestricted remote authority.

The native exercise performs a read-only identity query between two explicitly authorized Windows lab machines. It does not establish persistence, collect credentials or demonstrate every lateral-movement method. Service execution, scheduled tasks, RDP, SMB-specific paths and controlled pivoting still need their own developed labs.

Outcomes

  • Separate endpoint reachability, authentication, session authorization and execution.
  • Explain why remote administration becomes a security concern when the actor or path is unauthorized.
  • Evaluate synthetic path evidence without inventing missing edges.
  • Perform or correctly defer a bounded native remoting observation.
  • Name telemetry needed to corroborate a remote action and a defensive boundary that could stop it.

Trace the path, one decision at a time

Source process context
    → target naming and network route
    → responding management service
    → authenticated identity
    → permitted remoting endpoint
    → target-side process context
    → bounded operation and recorded result

Every arrow is a question. An endpoint can respond without accepting your account. An authenticated account can lack permission to use a session configuration. An established session can still lack access to the resource you intended to change.

PowerShell remoting over WinRM uses authentication and session permissions; domain scenarios commonly use Kerberos. Endpoint configuration affects who may connect. Transport configuration and authentication choices must be assessed together, rather than treating a port number as proof of the whole security model. Microsoft WinRM remoting security.

The same remote-management mechanism can support ordinary administration or unauthorized activity. A technique label does not decide intent. Compare the observed actor, source, target, action and time with the approved scope and operational baseline.

Session 1: work through four synthetic cases

These are original fictional records. LAB-ADMIN-01 and LAB-MEMBER-01 are worksheet labels, not targets to resolve or scan. The approved action is to query the target's current identity and hostname from the named administrator workstation during the exercise window.

Case Supplied observations Strongest defensible conclusion
A Management service returns a WS-Management response; no session attempt recorded A service responded; remote execution is unproven
B Authentication succeeds; endpoint denies session authorization An identity was accepted, but this endpoint did not permit the session
C Authorized source invokes identity query; target returns its identity and hostname; correlated endpoint log exists That bounded operation executed in the recorded target context
D Screenshot shows a command prompt; source, target, identity and time are absent Insufficient context to establish the claimed remote path

Before using the last column, hide it and write your own conclusions. Then add two columns: the next observation needed and one alternative explanation.

For case C, can you claim the account can install a service or read every file? No: the demonstrated command and its output do not establish those rights. For case B, would disabling a control make the original hypothesis true? It would change the tested system. Preserve the denial as a result and reassess the prerequisite instead.

Now add a fifth case: the same identity query occurs from an unapproved workstation. The command itself is harmless, but the source violates the exercise's allowed path. Which evidence would distinguish a mistaken scope record from an actual policy deviation? Keep administrative authorization and technical capability as separate fields.

Session 2: optional native Windows exercise

You need two disposable Windows lab machines, working lab naming, an instructor-configured WinRM endpoint and a lab identity already authorized for that endpoint. This chapter does not enable remoting or change firewall, trust or authentication settings. If these prerequisites are missing, finish the worksheet and mark native execution pending.

On the authorized source, replace the fictional hostname below with the single target named in your written lab scope. Run from PowerShell under the intended lab identity:

$DeadwireLabTarget = 'lab-member.example.test'
whoami
hostname
Test-WSMan -ComputerName $DeadwireLabTarget

Test-WSMan tests whether the remote WS-Management service responds. The default request is not proof that your identity can create a PowerShell session. Record response or error separately from the next step. Microsoft Test-WSMan reference.

For an already configured domain lab using Kerberos, perform exactly this bounded query:

$DeadwireSessionOptions = New-PSSessionOption -OpenTimeout 10000 -OperationTimeout 15000
Invoke-Command -ComputerName $DeadwireLabTarget -Authentication Kerberos -SessionOption $DeadwireSessionOptions -ScriptBlock {
    whoami
    hostname
}

The session options use milliseconds. Open timeout bounds connection establishment; operation timeout is not a universal wall-clock deadline for arbitrary scripts. This lesson uses two short read-only commands and names one target. Stop with Ctrl-C if it does not return within the planned lab step; preserve the error instead of widening the target list. Microsoft session options, Invoke-Command reference.

Compare source and returned hostnames and identities. The returned account need not look different from the source account; the execution location is still a separate fact. Save the exact command, target, time, output and configuration context. Reference-checking these instructions on macOS is not native Windows validation, and an empty transcript is not a completed practical.

Corroborate the observation

Ask the lab owner for the enabled remoting/authentication telemetry corresponding to the test window. Identify the actual log provider, event identifier, time, source, target and account fields observed. Do not insert a familiar event ID merely because a guide lists it: collection and audit settings affect what is present.

A useful detection hypothesis might be: “a permitted administrator identity invokes this management endpoint from a source outside the approved workstation set.” Required evidence includes source attribution, endpoint/session activity, identity and the approved baseline. A successful identity query alone does not supply the baseline.

Compare a known approved request with the fictional unapproved-source case before proposing a detector. The detection lesson explains why a rule must retain both misses and false alerts.

Evidence and acceptance

Submit the five-case worksheet and a path diagram with observed and unresolved edges. If native execution was performed, include the redacted source context, service probe, remote command result and available corroborating telemetry. If telemetry is missing, record that gap instead of claiming independent confirmation.

Acceptance requires distinguishing service response from execution and limiting the impact statement to the queried operation. The worksheet satisfies a reasoning exercise; it does not substitute for native practical evidence.

Safety and scope

Use one approved target and existing authorized access. Do not change TrustedHosts, enable weaker authentication, disable controls, collect credential material or create a remote service for this exercise. The query creates no intended persistent state; finish by confirming that no explicit persistent session was left in your source shell and close the lab terminal.

Teach-back

  1. What does a successful service probe leave unresolved?
  2. Why can an authenticated identity still be denied a remoting session?
  3. Which evidence proves execution location rather than just the account name?
  4. What separates an authorized administrative path from an unauthorized use of the same mechanism?

Continue: 05 · Detection and evidence, followed by 06 · Reporting.