tfMITRE ATT&CK technique

Windows Management Instrumentation T1047

Tactic: Execution
Platform: Windows
Version: 1.6
Created: 31 May 2017
Last modified: 12 May 2026
Contributors: @ionstorm; Olaf Hartong, Falcon Force; Tristan Madani

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.[1] WMI is an administration feature that provides a uniform environment to access Windows system components.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 3%

Threat groups97th percentile · 97% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 3%

Campaigns97th percentile · 97% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 4%

Tools & malware96th percentile · 96% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 2%

Detection rules98th percentile · 98% of ATT&CK techniques have this many detection rules written or fewer.

Windows Management Instrumentation MITRE reference T1047

Top 3%of all ATT&CK techniques for number of groups

42 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has utilized WMIC to log into the victim host and create a process process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

MirrorFaceG1054 ↗

Has leveraged WMIC on targeted systems post compromise.1

created 2026-04-171 referenceaka Earth Kasha

Medusa GroupG1051 ↗

Has utilized Windows Management Instrumentation to query system information.1 2 3

created 2025-10-153 references

Velvet AntG1047 ↗

Used the wmiexec.py tool within Impacket for remote process execution via WMI.1

created 2025-03-141 reference

APT42G1044 ↗

Has used Windows Management Instrumentation (WMI) to query anti-virus products.1

created 2025-01-081 reference

BlackByteG1043 ↗

Used WMI to delete Volume Shadow Copies on victim machines.1

created 2024-12-161 referenceaka Hecamede

All 42 groups for this technique · 6 newest in this preview

12 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

SharePoint ToolShell ExploitationC0058 ↗

During SharePoint ToolShell Exploitation, threat actors used WMI for execution.1

2025

C0027C0027 ↗

During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.1

2022

C0018C0018 ↗

During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (wmiprvse.exe) to execute a variety of encoded PowerShell scripts using the DownloadString method.1 2

2022

C0015C0015 ↗

During C0015, the threat actors used wmic and rundll32 to load Cobalt Strike onto a target host.1

2021

HomeLand JusticeC0038 ↗

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.1

2021–2022

Operation Dream JobC0022 ↗

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.1

2019–2020

All 12 campaigns for this technique · 6 newest in this preview

Offense vs defense T1047

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 11Sigma rules (cumulative) · 53Splunk ESCU (cumulative) · 20

first rule: 2018 Q2 · 11 of 12 campaigns plotted (Operation AkaiRyū (dated 2004) falls before the 2015 window)

Windows Management Instrumentation detection strategy DET0364

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection Strategy for WMI Execution Abuse on Windows

Enterprise

1 platform

AN1031 · Windows

Detects adversarial abuse of WMI to execute local or remote commands via WMIC, PowerShell, or COM API through a multi-event chain: process creation, command execution, and corresponding network connection if remote.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
WMI CreationDC0008	WinEventLog:WMI	EventCode=5857, 5858, 5860, 5861
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
WMIQueryScope	Restrict detection scope to suspicious WMI namespaces like `\root\cimv2`, `\root\subscription`.
TimeWindow	Set maximum allowable time window to correlate WMI process creation and remote connections.
UserContext	Tune based on interactive vs. system-level execution (e.g., via SYSTEM or low-privileged users).
RemoteDestinationThreshold	Number of unique remote hosts contacted using WMI within a time window.
SuspiciousCommandPatterns	Regex patterns to identify adversary-like usage (e.g., `wmic process call`, `powershell Invoke-WmiMethod`).

3 analytics

As described in ATT&CK, an adversary can use Windows Management Instrumentation (WMI) to view or manipulate objects on a remote host. It can be used to remotely edit configuration, start services, query files, and anything that can be done with a WMI class. When remote WMI requests are over RPC (CAR-2014-05-001), it connects to a DCOM interface within the RPC group netsvcs. To detect this activity, a sensor is needed at the network level that can decode RPC traffic or on the host where the communication can be detected more natively, such as Event Tracing for Windows. Using wireshark/tshark decoders, the WMI interfaces can be extracted so that WMI activity over RPC can be detected.

TypeTTPCoverageModerateSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-RTA	RPC Traffic Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	message	proto_info

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

To detect WMI over RPC (using DCOM), a sensor needs to exist that has the insight into individual connections and can actually decode and make sense of RPC traffic. Specifically, WMI can be detected by looking at RPC traffic where the target interface matches that of WMI, which is IRemUnknown2.

flows = search Flow:Message
wmi_flow = filter flows where (dest_port == 135 and proto_info.rpc_interface == "IRemUnknown2")
output wmi_flow

Adversaries can use Windows Management Instrumentation (WMI) to move laterally by launching executables remotely. For adversaries to achieve this, they must open a WMI connection to a remote host. This RPC activity is currently detected by CAR-2014-11-007. After the WMI connection has been initialized, a process can be remotely launched using the command: wmic /node:"<hostname>" process call create "<command line>", which is detected via CAR-2016-03-002.

TypeTTPCoverageHighSubmitted2014

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PLA	Process Lineage Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
flow	message	dest_port
flow	message	proto_info
flow	message	src_port
process	create	command_line
process	create	exe
process	create	parent_exe

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Look for instances of the WMI querying in network traffic, and find the cases where a process is launched immediately after a connection is seen. This essentially merges the request to start a remote process via WMI with the process execution. If other processes are spawned from wmiprvse.exe in this time frame, it is possible for race conditions to occur, and the wrong process may be merged. If this is the case, it may be useful to look deeper into the network traffic to see if the desired command can be extracted.

processes = search Process:Create
wmi_children = filter processes where (parent_exe == "wmiprvse.exe")

flows = search Flow:Message
wmi_flow = filter flows where (src_port >= 49152 and dest_port >= 49152 and proto_info.rpc_interface == "IRemUnknown2")

remote_wmi_process = join wmi_children, wmi_flow where (
 wmi_flow.time < wmi_children.time < wmi_flow.time + 1sec and
 wmi_flow.hostname == wmi_children.hostname
)

output remote_wmi_process

Adversaries may use Windows Management Instrumentation (WMI) to move laterally, by launching executables remotely.The analytic CAR-2014-12-001 describes how to detect these processes with network traffic monitoring and process monitoring on the target host. However, if the command line utility wmic.exe is used on the source host, then it can additionally be detected on an analytic. The command line on the source host is constructed into something like wmic.exe /node:"\<hostname\>" process call create "\<command line\>". It is possible to also connect via IP address, in which case the string "\<hostname\>" would instead look like IP Address.

TypeTTPCoverageLowSubmitted2016

D3FEND techniques

The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.

ID	Name
D3-PSA	Process Spawn Analysis

Data model references

The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.

Object	Action	Field
process	create	exe
process	create	command_line

Implementations

Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.

Looks for instances of wmic.exe as well as the substrings in the command line: * process call create * /node:

processes = search Process:Create
wmic = filter processes where (exe == "wmic.exe" and command_line == "* process call create *" and command_line == "* /node:*")
output wmic

Splunk version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\*\\wmic.exe" CommandLine="* process call create *"|search CommandLine="* /node:*"

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "wmic.exe" and command_line == "* process call create ")
  |filter command_line == "* /node:*"

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="C:\\Windows\\*\\wmic.exe" command="* process call create *" command="* /node:*"

Behavior Prevention on EndpointM1040

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution.

Execution PreventionM1038

Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.

Privileged Account ManagementM1026

Prevent credential overlap across systems of administrator and privileged accounts.

User Account ManagementM1018

By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.

Tests10Executorscmd 9 · PowerShell 1Need elevation2 of 10Have prerequisites5Have cleanup5Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

WMI Reconnaissance Users

windows

cmd

—

WMI Reconnaissance Processes

windows

cmd

—

WMI Reconnaissance Software

windows

cmd

—

WMI Reconnaissance List Remote Services

windows

cmd

—

An adversary might use WMI to check if a certain Remote Service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Input arguments

Name	Type	Default	Description
node	string	127.0.0.1	Ip Address
service_search_string	string	Spooler	Name Of Service

Attack command

wmic /node:"#{node}" service where (caption like "%#{service_search_string}%")

GUID3a52bae5-35a4-4ac9-b73d-cf30c1e15fac

WMI Execute Local Process

windows

cmd

—

Yes

This test uses wmic.exe to execute a process on the local host. When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.

Input arguments

Name	Type	Default	Description
process_to_execute	string	notepad.exe	Name or path of process to execute.

Attack command

wmic process call create #{process_to_execute}

Cleanup command

wmic process where name='#{process_to_execute}' delete >nul 2>&1

GUIDd92a1508-45e9-47dd-a5ad-9c04ebbcd1f1

WMI Execute Remote Process

windows

cmd

—

Yes

This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter. To clean up, provide the same node input as the one provided to run the test A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable

Input arguments

Name	Type	Default	Description
node	string	127.0.0.1	Ip Address
password	string	P@ssw0rd1	Password
user_name	string	DOMAIN\Administrator	Username
process_to_execute	string	notepad.exe	Name or path of process to execute.

Attack command

wmic /user:#{user_name} /password:#{password} /node:"#{node}" process call create #{process_to_execute}

Cleanup command

wmic /user:#{user_name} /password:#{password} /node:"#{node}" process where name='#{process_to_execute}' delete >nul 2>&1

GUID38af34a7-3ff3-42a4-86f7-0ddb0556aa7d

Create a Process using WMI Query and an Encoded Command

windows

cmd

—

Create a Process using obfuscated Win32_Process

windows

PowerShell

Required

—

Yes

This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic. Cybereason blog post No Win32_ProcessNeeded

Input arguments

Name	Type	Default	Description
new_class	string	Win32_Atomic	Derived class name
process_to_execute	string	notepad.exe	Name or path of process to execute.

Attack command

$Class = New-Object Management.ManagementClass(New-Object Management.ManagementPath("Win32_Process"))
$NewClass = $Class.Derive("#{new_class}")
$NewClass.Put()
Invoke-WmiMethod -Path #{new_class} -Name create -ArgumentList #{process_to_execute}

Cleanup command

$CleanupClass = New-Object Management.ManagementClass(New-Object Management.ManagementPath("#{new_class}"))
try { $CleanupClass.Delete() } catch {}

GUID73cea2f0-7741-45fb-aee4-af5fdac52911

WMI Execute rundll32

windows

cmd

—

Yes

This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter.

Input arguments

Name	Type	Default	Description
node	string	127.0.0.1	Ip Address
dll_to_execute	string	PathToAtomicsFolder\..\ExternalPayloads\calc.dll	Path to DLL.
function_to_execute	string	StartW	Name of DLL function to call

Attack command

wmic /node:#{node} process call create "rundll32.exe \"#{dll_to_execute}\" #{function_to_execute}"

Cleanup command

taskkill /f /im calculator.exe

Prerequisite

DLL with function to execute must exist on disk at specified location (#{dll_to_execute})

Check

if (Test-Path "#{dll_to_execute}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/bin/calc.dll?raw=true" -OutFile "#{dll_to_execute}"

GUIDd7b24b43-ad6e-4ede-904a-bd48481a236c

Application uninstall using WMIC

windows

cmd

Required

Yes

Emulates uninstalling applications using WMIC. This method only works if the product was installed with an msi file. APTs have been seen using this to uninstall security products.

Input arguments

Name	Type	Default	Description
node	string	127.0.0.1	Computer the action is being executed against but defaults to the localhost.
product	string	Tightvnc	Enter the product name being uninstalled. This will default to TightVNC.

Attack command

wmic /node:"#{node}" product where "name like '#{product}%%'" call uninstall

Cleanup command

msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart

Prerequisite

TightVNC must be installed.

Check

if ((Test-Path "C:\Program Files\TightVNC\tvnviewer.exe")-Or (Test-Path "C:\Program Files (x86)\TightVNC\tvnviewer.exe")) {exit 0} else {exit 1}

Satisfy

Invoke-WebRequest 'https://www.tightvnc.com/download/2.8.63/tightvnc-2.8.63-gpl-setup-64bit.msi' -OutFile "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi"
start-sleep -s 10
msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart
start-sleep -s 15

GUID687c2ae3-e3bf-4dfb-8e37-471037c3ba97

Tests from Atomic Red Team (MIT licence) · technique definition

Windows Management Instrumentation detections T1047

73 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 2%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs