WinRM Invoke-Command

Invoke-Command -ComputerName <target> -Credential <cred> -ScriptBlock { <payload> }

Executes commands on a remote host via WinRM (WS-Management, port 5985/5986), the official Windows remote management mechanism.

When the remote host has WinRM enabled (default on modern servers) and you have credentials with local admin privileges. It's the most 'legitimate' remote execution method: it uses the same infrastructure admins use.

If WinRM is disabled or the firewall blocks 5985/5986. If you need total stealth, remember that Invoke-Command leaves 4104 with the full scriptblock on the remote host: visibility to the blue team is high.