Which protocol enables running a payload on a remote Windows system to modify services and the registry for lateral movement?

Which protocol enables running a payload on a remote Windows system to modify services and the registry for lateral movement?

• A. RemoteExec
• B. Keylogger Keyboard
• C. Windows Remote Management (WinRM)
• D. PC/BIOS Embedded

Answer: (C)

Running a payload on a remote Windows system to modify services and the registry for lateral movement relies on a mechanism that can execute commands and scripts across hosts. Windows Remote Management enables remote PowerShell or command execution over the WS-Management protocol, making it a common path for attackers to push a payload, adjust services, or alter registry entries to achieve persistence and move laterally. It typically uses ports 5985 (HTTP) and 5986 (HTTPS) and relies on authenticated, encrypted sessions, which makes it suitable for remote administration as well as exploitation if exposed. The other options don’t fit: RemoteExec isn’t a native Windows remoting protocol; a keylogger is for capturing input; PC/BIOS Embedded is unrelated to network-based payload execution on Windows.

Running a payload on a remote Windows system to modify services and the registry for lateral movement relies on a mechanism that can execute commands and scripts across hosts. Windows Remote Management enables remote PowerShell or command execution over the WS-Management protocol, making it a common path for attackers to push a payload, adjust services, or alter registry entries to achieve persistence and move laterally. It typically uses ports 5985 (HTTP) and 5986 (HTTPS) and relies on authenticated, encrypted sessions, which makes it suitable for remote administration as well as exploitation if exposed. The other options don’t fit: RemoteExec isn’t a native Windows remoting protocol; a keylogger is for capturing input; PC/BIOS Embedded is unrelated to network-based payload execution on Windows.