Windows Management Instrumentation

During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys. ^[5]

Action RAT can use WMI to gather AV products installed on an infected host.^[6]

Agent Tesla has used wmi queries to gather information from the system.^[7]

Akira will leverage COM objects accessed through WMI during execution to evade detection.^[8]

APT29 used WMI to steal credentials and execute backdoors at a future time.^[9]

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.^[10]

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.^[11][12] APT41 has executed files through Windows Management Instrumentation (WMI).^[13]

APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.^[14]

Aquatic Panda used WMI for lateral movement in victim environments.^[15]

Astaroth uses WMIC to execute payloads. ^[16]

Avaddon uses wmic.exe to delete shadow copies.^[17]

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.^[18][19]

Bazar can execute a WMI query to gather information about the installed antivirus engine.^[20][21]

Black Basta has used WMI to execute files over the network.^[22]

BlackByte used WMI to delete Volume Shadow Copies on victim machines.^[23]

BlackCat can use wmic.exe to delete shadow copies on compromised networks.^[24]

A BlackEnergy 2 plug-in uses WMI to gather victim host details.^[25]

Blue Mockingbird has used wmic.exe to set environment variables.^[26]

Brute Ratel C4 can use WMI to move laterally.^[27]

Bumblebee can use WMI to gather system information and to spawn processes for code injection.^[28][29][30]

During C0015, the threat actors used wmic and rundll32 to load Cobalt Strike onto a target host.^[31]

During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (wmiprvse.exe) to execute a variety of encoded PowerShell scripts using the DownloadString method.^[32][33]

During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.^[34]

CharmPower can use wmic to gather information from a system.^[35]

Chimera has used WMIC to execute remote commands.^[36][37]

Cinnamon Tempest has used Impacket for lateral movement via WMI.^[38][39]

Cobalt Strike can use WMI to deliver a payload to a remote host.^[40][41][31]

Covenant can utilize WMI to install new Grunt listeners through XSL files or command one-liners.^[42]

CrackMapExec can execute remote commands using Windows Management Instrumentation.^[43]

DarkGate has used WMI to execute files over the network and to obtain information about the domain.^[44]

DarkTortilla can use WMI queries to obtain system information.^[45]

DarkWatchman can use WMI to execute commands.^[46]

DEATHRANSOM has the ability to use WMI to delete volume shadow copies.^[47]

The Deep Panda group is known to utilize WMI for lateral movement.^[48]

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.^[49]

Earth Lusca used a VBA script to execute WMI.^[50]

EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.^[51]

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.^[52]

Emotet has used WMI to execute powershell.exe.^[53]

Empire can use WMI to deliver a payload to a remote host.^[54]

EvilBunny has used WMI to gather information about the system.^[55]

EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.^[56]

FELIXROOT uses WMI to query the Windows Registry.^[57]

FIN13 has utilized WMI to execute commands and move laterally on compromised Windows machines.^[58][59]

FIN6 has used WMI to automate the remote execution of PowerShell scripts.^[60]

FIN7 has used WMI to install malware on targeted systems.^[61]

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.^{[62][63][64][65]}

FIVEHANDS can use WMI to delete files on a target machine.^[47][66]

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.^[67]

During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.^[68]

FunnyDream can use WMI to open a Windows command shell on a remote machine.^[69]

During FunnyDream, the threat actors used wmiexec.vbs to run remote commands.^[69]

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.^[70]

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address.^[71][72]

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).^[73]

HALFBAKED can use WMI queries to gather system information.^[74]

HELLOKITTY can use WMI to delete volume shadow copies.^[47]

HermeticWizard can use WMI to create a new process on a remote machine via C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll.^[75]

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.^[76]

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.^[77]

IcedID has used WMI to execute binaries.^[78][79]

IMAPLoader uses WMI queries to query system information on victim hosts.^[80]

Impacket's wmiexec module can be used to execute commands through WMI.^[81][82]

INC Ransom has used WMIC to deploy ransomware.^[83][84][85]

INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.^[84][86]

Indrik Spider has used WMIC to execute commands on remote computers.^[87]

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.^[88]

Kazuar obtains a list of running processes through WMI querying.^[89]

Koadic can use WMI to execute commands.^[90]

KOMPROGO is capable of running WMI queries.^[91]

Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.^[92][93]

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.^{[94][95][96][97]}

Leviathan has used WMI for execution.^[98]

LockBit 2.0 can use wmic.exe to delete volume shadow copies.^[99]

Lotus Blossom has used WMI to enable lateral movement.^[100]

Lucifer can use WMI to log into remote machines for propagation.^[101]

LunarWeb can use WMI queries for discovery on the victim host.^[102]

Magic Hound has used a tool to run cmd /c wmic computersystem get domain for discovery.^[103]

Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.^[104][105]

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.^{[106][107][108]}

Meteor can use wmic.exe as part of its effort to delete shadow copies.^[109]

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.^[110][111]

MoleNet can perform WMI commands on the system.^[112]

Mosquito's installer uses WMI to search for antivirus display names.^[113]

MuddyWater has used malware that leveraged WMI for execution and querying host information.^{[114][115][116][117]}

Mustang Panda has executed PowerShell scripts via WMI.^[118][119]

Naikon has used WMIC.exe for lateral movement.^[120]

Netwalker can use WMI to delete Shadow Volumes.^[121]

NotPetya can use wmic to help propagate itself across a network.^[122][123]

Octopus has used wmic.exe for local discovery information.^[124]

OilRig has used WMI for execution.^[125][126]

Olympic Destroyer uses WMI to help propagate itself across a network.^[127]

OopsIE uses WMI to perform discovery techniques.^[128]

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.^[129]

During Operation Wocao, threat actors has used WMI to execute commands.^[130]

PoshC2 has a number of modules that use WMI to execute tasks.^[131]

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.^[132][133]

POWERSTATS can use WMI queries to retrieve data from compromised hosts.^[134][115]

POWRUNER may use WMI when collecting information about a victim.^[135]

ProLock can use WMIC to execute scripts on targeted hosts.^[136]

PyDCrypt has attempted to execute with WMIC.^[137]

QakBot can execute WMI queries to gather information.^[138]

Raspberry Robin can execute via LNK containing a command to run a legitimate executable, such as wmic.exe, to download a malicious Windows Installer (MSI) package.^[139]

RATANKBA uses WMI to perform process monitoring.^[140][141]

Remexi executes received commands with wmic.exe (for WMI commands). ^[142]

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.^[143][144]

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.^[145][146]

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.^[5][147]

Sardonic can use WMI to execute PowerShell commands on a compromised machine.^[148]

SharpStage can use WMI for execution.^[112][149]

ShrinkLocker uses WMI to query information about the victim operating system.^[150]

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.^[151]

SILENTTRINITY can use WMI for lateral movement.^[152]

Snip3 can query the WMI class Win32_ComputerSystem to gather information.^[153]

SocGholish has used WMI calls for script execution and system profiling.^[154]

During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.^[155][156]

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).^[157]

StoneDrill has used the WMI command-line (WMIC) utility to run tasks.^[158]

Stuxnet used WMI with an explorer.exe token to execute on a remote share.^[159]

SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.^[160]

SVCReady can use WMI queries to detect the presence of a virtual machine environment.^[161]

SysUpdate can use WMI for execution on a compromised host.^[162]

TA2541 has used WMI to query targeted systems for security products.^[163]

TAMECAT has used Windows Management Instrumentation (WMI) to query anti-virus products.^[14]

A Threat Group-3390 tool can use WMI to execute a binary.^[164]

ToddyCat has used WMI to execute scripts for post exploit document collection.^[165]

Ursnif droppers have used WMI classes to execute PowerShell commands.^[166]

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.^[167]

Velvet Ant used the wmiexec.py tool within Impacket for remote process execution via WMI.^[82]

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.^{[168][169][170][171]}

WannaCry utilizes wmic to delete shadow copies.^{[172][173][174]}

Windshift has used WMI to collect information about target machines.^[175]

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.^{[176][177][178][179][180]}

One variant of Zebrocy uses WMI queries to gather information.^[181]

On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution. ^[182]

Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.^[183]

Prevent credential overlap across systems of administrator and privileged accounts. ^[184]

By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.