@ionstorm; Olaf Hartong, Falcon Force; Tristan Madani
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.[1] WMI is an administration feature that provides a uniform environment to access Windows system components.
An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as Execution of commands and payloads.[4] For example, wmic.exe can be abused by an adversary to delete shadow copies with the command wmic.exe Shadowcopy Delete (i.e., Inhibit System Recovery).[5]
**Note:** wmic.exe is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by PowerShell as the primary WMI interface.[6] In addition to PowerShell and tools like wbemtool.exe, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.[6]
Threat groups97th percentile · 97% of ATT&CK techniques have fewer threat groups attributed.
12
CampaignsTop 3%
Campaigns97th percentile · 97% of ATT&CK techniques have fewer campaigns recorded.
93
Tools & malwareTop 4%
Tools & malware96th percentile · 96% of ATT&CK techniques have fewer tools implementing them.
71
Detection rulesTop 2%
Detection rules98th percentile · 98% of ATT&CK techniques have fewer detection rules written.
Windows Management Instrumentation MITRE reference T1047
Top 3%of all ATT&CK techniques for number of groups
42 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has utilized WMIC to log into the victim host and create a process process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”.1
During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (wmiprvse.exe) to execute a variety of encoded PowerShell scripts using the DownloadString method.12
During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.1
2021–2022
All 12 campaigns for this technique · 6 newest in this preview
93 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Windows Management Instrumentation detection strategy DET0364
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for WMI Execution Abuse on Windows
Enterprise
1 platform
AN1031 · Windows
Detects adversarial abuse of WMI to execute local or remote commands via WMIC, PowerShell, or COM API through a multi-event chain: process creation, command execution, and corresponding network connection if remote.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
WMIQueryScope
Restrict detection scope to suspicious WMI namespaces like \root\cimv2, \root\subscription.
TimeWindow
Set maximum allowable time window to correlate WMI process creation and remote connections.
UserContext
Tune based on interactive vs. system-level execution (e.g., via SYSTEM or low-privileged users).
RemoteDestinationThreshold
Number of unique remote hosts contacted using WMI within a time window.
SuspiciousCommandPatterns
Regex patterns to identify adversary-like usage (e.g., wmic process call, powershell Invoke-WmiMethod).
3 analytics
As described in ATT&CK, an adversary can use Windows Management Instrumentation (WMI) to view or manipulate objects on a remote host. It can be used to remotely edit configuration, start services, query files, and anything that can be done with a WMI class. When remote WMI requests are over RPC (CAR-2014-05-001), it connects to a DCOM interface within the RPC group netsvcs. To detect this activity, a sensor is needed at the network level that can decode RPC traffic or on the host where the communication can be detected more natively, such as Event Tracing for Windows. Using wireshark/tshark decoders, the WMI interfaces can be extracted so that WMI activity over RPC can be detected.
TypeTTPCoverageModerateSubmitted2014
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
To detect WMI over RPC (using DCOM), a sensor needs to exist that has the insight into individual connections and can actually decode and make sense of RPC traffic. Specifically, WMI can be detected by looking at RPC traffic where the target interface matches that of WMI, which is IRemUnknown2.
flows = search Flow:Message
wmi_flow = filter flows where (dest_port == 135 and proto_info.rpc_interface == "IRemUnknown2")
output wmi_flow
Adversaries can use Windows Management Instrumentation (WMI) to move laterally by launching executables remotely. For adversaries to achieve this, they must open a WMI connection to a remote host. This RPC activity is currently detected by CAR-2014-11-007. After the WMI connection has been initialized, a process can be remotely launched using the command: wmic /node:"<hostname>" process call create "<command line>", which is detected via CAR-2016-03-002.
TypeTTPCoverageHighSubmitted2014
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
Look for instances of the WMI querying in network traffic, and find the cases where a process is launched immediately after a connection is seen. This essentially merges the request to start a remote process via WMI with the process execution. If other processes are spawned from wmiprvse.exe in this time frame, it is possible for race conditions to occur, and the wrong process may be merged. If this is the case, it may be useful to look deeper into the network traffic to see if the desired command can be extracted.
processes = search Process:Create
wmi_children = filter processes where (parent_exe == "wmiprvse.exe")
flows = search Flow:Message
wmi_flow = filter flows where (src_port >= 49152 and dest_port >= 49152 and proto_info.rpc_interface == "IRemUnknown2")
remote_wmi_process = join wmi_children, wmi_flow where (
wmi_flow.time < wmi_children.time < wmi_flow.time + 1sec and
wmi_flow.hostname == wmi_children.hostname
)
output remote_wmi_process
Adversaries may use Windows Management Instrumentation (WMI) to move laterally, by launching executables remotely.The analytic CAR-2014-12-001 describes how to detect these processes with network traffic monitoring and process monitoring on the target host. However, if the command line utility wmic.exe is used on the source host, then it can additionally be detected on an analytic. The command line on the source host is constructed into something like wmic.exe /node:"\<hostname\>" process call create "\<command line\>". It is possible to also connect via IP address, in which case the string "\<hostname\>" would instead look like IP Address.
TypeTTPCoverageLowSubmitted2016
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution.
Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.
By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.
Tests12Executorscommand_prompt 9 · powershell 3Need elevation2 of 12Have prerequisites7Have cleanup7Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
WMI Reconnaissance Users
windows
command_prompt
—
1
—
An adversary might use WMI to list all local User Accounts.
When the test completes , there should be local user accounts information displayed on the command line.
Attack Commandsrun with command_prompt
wmic useraccount get /ALL /format:csv
Dependenciesrun with powershell
Description
wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.
Check Prereq Commands
if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}
An adversary might use WMI to list Processes running on the compromised host.
When the test completes , there should be running processes listed on the command line.
Attack Commandsrun with command_prompt
wmic process get caption,executablepath,commandline /format:csv
Dependenciesrun with powershell
Description
wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.
Check Prereq Commands
if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}
An adversary might use WMI to list installed Software hotfix and patches.
When the test completes, there should be a list of installed patches and when they were installed.
Attack Commandsrun with command_prompt
wmic qfe get description,installedOn /format:csv
Dependenciesrun with powershell
Description
wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.
Check Prereq Commands
if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}
An adversary might use WMI to check if a certain Remote Service is running on a remote device.
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable"
if the provided remote host is unreachable
Inputs
Name
Description
Type
Default Value
node
Ip Address
string
127.0.0.1
service_search_string
Name Of Service
string
Spooler
Attack Commandsrun with command_prompt
wmic /node:"#{node}" service where (caption like "%#{service_search_string}%")
GUID0fd48ef7-d890-4e93-a533-f7dedd5191d3
05
WMI Execute Local Process
windows
command_prompt
—
—
Yes
This test uses wmic.exe to execute a process on the local host.
When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.
Inputs
Name
Description
Type
Default Value
process_to_execute
Name or path of process to execute.
string
notepad.exe
Attack Commandsrun with command_prompt
wmic process call create #{process_to_execute}
Cleanup Commands
wmic process where name='#{process_to_execute}' delete >nul 2>&1
GUIDb3bdfc91-b33e-4c6d-a5c8-d64bee0276b3
06
WMI Execute Remote Process
windows
command_prompt
—
—
Yes
This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter.
To clean up, provide the same node input as the one provided to run the test
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable
Inputs
Name
Description
Type
Default Value
node
Ip Address
string
127.0.0.1
password
Password
string
P@ssw0rd1
user_name
Username
string
DOMAIN\Administrator
process_to_execute
Name or path of process to execute.
string
notepad.exe
Attack Commandsrun with command_prompt
wmic /user:#{user_name} /password:#{password} /node:"#{node}" process call create #{process_to_execute}
Cleanup Commands
wmic /user:#{user_name} /password:#{password} /node:"#{node}" process where name='#{process_to_execute}' delete >nul 2>&1
GUID9c8ef159-c666-472f-9874-90c8d60d136b
07
Create a Process using WMI Query and an Encoded Command
windows
command_prompt
—
—
—
Solarigate persistence is achieved via backdoors deployed via various techniques including using PowerShell with an EncodedCommand
Powershell -nop -exec bypass -EncodedCommand <encoded command>
Where the –EncodedCommand, once decoded, would resemble:
Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\windows\idmu\common\ypprop.dll _XInitImageFuncPtrs’ -ComputerName WORKSTATION
The EncodedCommand in this atomic is the following: Invoke-WmiMethod -Path win32_process -Name create -ArgumentList notepad.exe
You should expect to see notepad.exe running after execution of this test.
Solarigate Analysis from Microsoft
This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic.
Cybereason blog post No Win32_ProcessNeeded
Inputs
Name
Description
Type
Default Value
new_class
Derived class name
string
Win32_Atomic
process_to_execute
Name or path of process to execute.
string
notepad.exe
Attack Commandsrun with powershellelevation required (root or admin)
Emulates uninstalling applications using WMIC. This method only works if the product was installed with an msi file. APTs have been seen using this to uninstall security products.
Inputs
Name
Description
Type
Default Value
node
Computer the action is being executed against but defaults to the localhost.
string
127.0.0.1
product
Enter the product name being uninstalled. This will default to TightVNC.
string
Tightvnc
Attack Commandsrun with command_promptelevation required (root or admin)
wmic /node:"#{node}" product where "name like '#{product}%%'" call uninstall
wmiexec.py is tool included in the Impacket toolkit that allows to execute commands remotely on a Windows System using WMI (Windows management Instrumentation).
Inputs
Name
Description
Type
Default Value
command
Command to execute on the target machine.
string
ipconfig
password
password for the target machine
string
1234
user_name
username on the target machine.
string
$env:USERNAME
target_host
IP address or hostname of the target machine.
string
$env:COMPUTERNAME
uv_tool_dir
Directory where uv installs tool virtualenvs
path
$env:TEMP\uv\tools
optional_args
Additional arguments to use (like -k -no-pass)
string
—
target_domain
Domain of the Target machine.
string
$env:USERDNSDOMAIN
uv_install_dir
Directory where the uv binary is installed
path
$env:TEMP\uv
uv_tool_bin_dir
Directory where uv places tool executable shims
path
$env:TEMP\uv\tools\bin
Attack Commandsrun with powershell
cd #{uv_tool_bin_dir}
$optionalArgs = "#{optional_args}"
$argList = @("#{command}")
if (-not [string]::IsNullOrWhiteSpace($optionalArgs)) { $argList += $optionalArgs.Split(" ") }
.\wmiexec.py #{target_domain}/#{user_name}:#{password}@#{target_host} @argList
AveMaria/Warzone program.bat WMIC Process Creation
windows
powershell
—
1
Yes
Emulates the evasive behavior of the Ave Maria/Warzone RAT, which follows these steps:
1. Creates a batch script (program_path) that runs commands found in its own ADS named start (program_path:start)
2. Writes to program_path:start a wmiexec command that starts a process from an ADS named ApplicationData of a specified file (ads_host:ApplicationData)
3. Writes to the ADS ads_host:ApplicationData the contents of an executable (normally would be the ransomware)
4. Runs the batch script, which runs everything that was set up
Reference: https://www.splunk.com/en_us/blog/security/defending-the-gates-understanding-and-detecting-ave-maria-warzone-rat.html
Inputs
Name
Description
Type
Default Value
ads_host
File the Alternate Data Stream ApplicationData is attached to
path
$env:TEMP\ads
program_path
Full filepath (including filename) that the batch script is created to
path
$env:TEMP\program.bat
payload_binary
Benign executable to persist (stand-in for the malware payload)
Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.
The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. (...)
The following analytic detects the spawning of a PowerShell process as a child or grandchild of commonly abused processes like services.exe, wmiprvse.exe, svchost.exe, wsmprovhost.exe, and mmc.exe. (...)
Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
2019-01-16
2023-02-14
526be59f-a573-4eea-b5f7-f0973207634d
Splunk
The following analytic detects the execution of a process by `WmiPrvSE.exe`, indicating potential use of WMI (Windows Management Instrumentation) for process creation. (...)
Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems)
2025-11-15
—
4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d
Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). (...)
Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.). (...)
The following analytic detects the execution of `powershell.exe` using the `Invoke-WmiMethod` cmdlet to start a process on a remote endpoint via WMI. (...)
The following analytic detects the execution of the `Invoke-WmiMethod` commandlet with parameters used to start a process on a remote endpoint via WMI, leveraging PowerShell Script Block Logging (EventCode=4104). (...)
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access. (...)
The following analytic detects the use of WMIC (Windows Management Instrumentation Command-line) for reconnaissance and system information discovery on Windows endpoints. (...)
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.