Evil-WinRM: shell PowerShell remota via WinRM per post-exploitation Windows. Pass-the-hash, Kerberos ticket, AMSI bypass, in-memory execution .NET assembly per lateral movement enterprise.