Exploring WinRM plugins for lateral movement

This report describes a proof-of-concept technique for stealthy lateral movement using custom WinRM plugins: it details building and registering a plugin DLL, invoking its Put method remotely via WinRM/COM to execute payloads, and installation/uninstallation steps (including registry and service manipulation). The author provides code snippets, BOF commands for operator use, observations about the hosting process (winprovhost.exe), and notes on detection by Defender.