Windows Management Instrumentation

APT29 used WMI to steal credentials and execute backdoors at a future time.^[6]

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.^[7]

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.^[8]

Astaroth uses WMIC to execute payloads. ^[9]

A BlackEnergy 2 plug-in uses WMI to gather victim host details.^[10]

Blue Mockingbird has used wmic.exe to set environment variables.^[11]

Chimera has used WMIC to execute remote commands.^[12]

Cobalt Strike can use WMI to deliver a payload to a remote host.^[13]

CrackMapExec can execute remote commands using Windows Management Instrumentation.^[14]

The Deep Panda group is known to utilize WMI for lateral movement.^[15]

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.^[16]

Emotet has used WMI to execute powershell.exe.^[17]

Empire can use WMI to deliver a payload to a remote host.^[18]

EvilBunny has used WMI to gather information about the system.^[19]

FELIXROOT uses WMI to query the Windows Registry.^[20]

FIN6 has used WMI to automate the remote execution of PowerShell scripts.^[21]

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC during and post compromise cleanup activities.^[22][23]

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.^[24]

Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.^[25]

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).^[26]

HALFBAKED can use WMI queries to gather system information.^[27]

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.^[28]

IcedID has used WMI to execute binaries.^[29]

Impacket's wmiexec module can be used to execute commands through WMI.^[30]

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.^[31]

Kazuar obtains a list of running processes through WMI querying.^[32]

Koadic can use WMI to execute commands.^[33]

KOMPROGO is capable of running WMI queries.^[34]

Lazarus Group malware SierraAlfa uses the Windows Management Instrumentation Command-line application wmic to start itself on a target system during lateral movement.^[35][36]

Leviathan has used WMI for execution.^[37]

Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.^[38][39]

menuPass uses a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.^[40][41]

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.^[42][43]

Mosquito's installer uses WMI to search for antivirus display names.^[44]

MuddyWater has used malware that leveraged WMI for execution and querying host information.^[45][46][47]

Netwalker can use WMI to delete Shadow Volumes.^[48]

NotPetya can use wmic to help propagate itself across a network.^[49][50]

Octopus uses wmic.exe for local discovery information.^[51]

OilRig has used WMI for execution.^[52]

Olympic Destroyer uses WMI to help propagate itself across a network.^[53]

OopsIE uses WMI to perform discovery techniques.^[54]

PoshC2 has a number of modules that use WMI to execute tasks.^[55]

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.^[56][57]

POWERSTATS can use WMI queries to retrieve data from compromised hosts.^[58][46]

POWRUNER may use WMI when collecting information about a victim.^[59]

RATANKBA uses WMI to perform process monitoring.^[60][61]

Remexi executes received commands with wmic.exe (for WMI commands). ^[62]

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.^[63][64]

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.^[65][66]

Soft Cell used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.^[67]

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).^[68]

StoneDrill has used the WMI command-line (WMIC) utility to run tasks.^[69]

Sunburst used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.^[70]

A Threat Group-3390 tool can use WMI to execute a binary.^[71]

UNC2452 used WMI for the remote execution of files for lateral movement.^[72][73]

Ursnif droppers have used WMI classes to execute PowerShell commands.^[74]

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.^[75]

WannaCry utilizes wmic to delete shadow copies.^[76][77][78]

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.^{[79][80][81][82]}

One variant of Zebrocy uses WMI queries to gather information.^[83]

Prevent credential overlap across systems of administrator and privileged accounts. ^[5]

By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.