WMI, PSExec & Remote Execution Techniques

You have valid credentials for a remote Windows host and need to execute commands on it. Compare and reason about the available remote execution techniques.

**Technique Comparison**
- How does PSExec work at the Windows service level and what artifacts does it leave?
- How does WMI remote execution work and how does it differ from PSExec in terms of detection?
- What is WinRM / PowerShell Remoting and what are its prerequisites?
- What is DCOM lateral movement and why is it useful for bypassing certain defenses?

**Artifact Analysis**
| Technique | Service Created? | Network Share Used? | Event Log? | Registry? |
- Fill this matrix for: PSExec, WMI, WinRM, DCOM, SMB + scheduled task

**Choosing the Right Technique**
- When would you prefer WMI over PSExec?
- When does WinRM give you capabilities that WMI cannot?
- In an EDR-heavy environment, which technique generates the least telemetry?
- What happens if port 445 is blocked but 5985 is open?

**LOLBins for Remote Execution**
- How does `at.exe` and `schtasks.exe` enable remote code execution?
- How can `wmic.exe` be used for lateral movement and why is it monitored?
- What native Windows binary can you use to copy and execute files remotely without PSExec?

**Operational Cleanliness**
- How do you remove artifacts after successful lateral movement?
- Which techniques require manual cleanup vs clean themselves up?

Output:
- Technique selection matrix with detection risk ratings
- CrackMapExec commands for each technique
- Impacket suite commands for each technique