CrackMapExec winrm

crackmapexec winrm <cidr> -u <user> -p '<pass>'

Validates credentials against hosts with WinRM enabled (port 5985/5986).

To verify if credentials are valid on systems with WinRM (Windows Remote Management) active, allowing remote command execution (PowerShell). It's a stealthier alternative to SMB in some cases.

If the target doesn't have WinRM enabled or is blocked by firewall. Also if you don't have credentials.