Windows Management Instrumentation

Agent Tesla has used wmi queries to gather information from the system.^[4]

APT29 used WMI to steal credentials and execute backdoors at a future time.^[5] They have also used WMI for the remote execution of files for lateral movement.^[6][7]

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.^[8]

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.^[9][10]

Astaroth uses WMIC to execute payloads. ^[11]

Avaddon uses wmic.exe to delete shadow copies.^[12]

Bazar can execute a WMI query to gather information about the installed antivirus engine.^[13][14]

A BlackEnergy 2 plug-in uses WMI to gather victim host details.^[15]

Blue Mockingbird has used wmic.exe to set environment variables.^[16]

CharmPower can use wmic to gather information from a system.^[17]

Chimera has used WMIC to execute remote commands.^[18][19]

Cobalt Strike can use WMI to deliver a payload to a remote host.^[20][21]

CrackMapExec can execute remote commands using Windows Management Instrumentation.^[22]

DarkWatchman can use WMI to execute commands.^[23]

DEATHRANSOM has the ability to use WMI to delete volume shadow copies.^[24]

The Deep Panda group is known to utilize WMI for lateral movement.^[25]

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.^[26]

EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.^[27]

Emotet has used WMI to execute powershell.exe.^[28]

Empire can use WMI to deliver a payload to a remote host.^[29]

EvilBunny has used WMI to gather information about the system.^[30]

EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.^[31]

FELIXROOT uses WMI to query the Windows Registry.^[32]

FIN6 has used WMI to automate the remote execution of PowerShell scripts.^[33]

FIN7 has used WMI to install malware on targeted systems.^[34]

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.^[35][36][37]

FIVEHANDS can use WMI to delete files on a target machine.^[24][38]

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.^[39]

Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.^[40]

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.^[41]

Gamaredon Group has used WMI to execute scripts used for discovery.^[42]

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).^[43]

HALFBAKED can use WMI queries to gather system information.^[44]

HELLOKITTY can use WMI to delete volume shadow copies.^[24]

HermeticWizard can use WMI to create a new process on a remote machine via C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll.^[45]

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.^[46]

IcedID has used WMI to execute binaries.^[47]

Impacket's wmiexec module can be used to execute commands through WMI.^[48]

Indrik Spider has used WMIC to execute commands on remote computers.^[49]

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.^[50]

Kazuar obtains a list of running processes through WMI querying.^[51]

Koadic can use WMI to execute commands.^[52]

KOMPROGO is capable of running WMI queries.^[53]

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.^{[54][55][56][57][58]}

Leviathan has used WMI for execution.^[59]

Lucifer can use WMI to log into remote machines for propagation.^[60]

Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.^[61][62]

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.^[63][64][65]

Meteor can use wmic.exe as part of its effort to delete shadow copies.^[66]

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.^[67][68]

MoleNet can perform WMI commands on the system.^[69]

Mosquito's installer uses WMI to search for antivirus display names.^[70]

MuddyWater has used malware that leveraged WMI for execution and querying host information.^[71][72][73]

Mustang Panda has executed PowerShell scripts via WMI.^[74][75]

Naikon has used WMIC.exe for lateral movement.^[76]

Netwalker can use WMI to delete Shadow Volumes.^[77]

NotPetya can use wmic to help propagate itself across a network.^[78][79]

Octopus has used wmic.exe for local discovery information.^[80]

OilRig has used WMI for execution.^[81]

Olympic Destroyer uses WMI to help propagate itself across a network.^[82]

OopsIE uses WMI to perform discovery techniques.^[83]

Operation Wocao has used WMI to execute commands.^[84]

PoshC2 has a number of modules that use WMI to execute tasks.^[85]

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.^[86][87]

POWERSTATS can use WMI queries to retrieve data from compromised hosts.^[88][72]

POWRUNER may use WMI when collecting information about a victim.^[89]

ProLock can use WMIC to execute scripts on targeted hosts.^[90]

QakBot can execute WMI queries to gather information.^[91]

RATANKBA uses WMI to perform process monitoring.^[92][93]

Remexi executes received commands with wmic.exe (for WMI commands). ^[94]

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.^[95][96]

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.^[97][98]

Sandworm Team has used VBScript to run WMI queries.^[99]

SharpStage can use WMI for execution.^[69][100]

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.^[101]

SILENTTRINITY can use WMI for lateral movement.^[102]

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).^[103]

StoneDrill has used the WMI command-line (WMIC) utility to run tasks.^[104]

Stuxnet used WMI with an explorer.exe token to execute on a remote share.^[105]

SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.^[106]

SysUpdate can use WMI for execution on a compromised host.^[107]

A Threat Group-3390 tool can use WMI to execute a binary.^[108]

Ursnif droppers have used WMI classes to execute PowerShell commands.^[109]

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.^[110]

WannaCry utilizes wmic to delete shadow copies.^{[111][112][113]}

Windshift has used WMI to collect information about target machines.^[114]

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.^{[115][116][117][118]}

One variant of Zebrocy uses WMI queries to gather information.^[119]

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution. ^[120]

Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.^[121]

Prevent credential overlap across systems of administrator and privileged accounts. ^[2]

By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.