Windows Management Instrumentation

APT29 used WMI to steal credentials and execute backdoors at a future time.^[57]

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.^[64]

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.^[67]

Astaroth uses WMIC to execute payloads. ^[36]

A BlackEnergy 2 plug-in uses WMI to gather victim host details.^[16]

Blue Mockingbird has used wmic.exe to set environment variables.^[70]

Cobalt Strike can use WMI to deliver a payload to a remote host.^[6]

The Deep Panda group is known to utilize WMI for lateral movement.^[52]

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.^[26]

Emotet has used WMI to execute powershell.exe.^[46]

Empire can use WMI to deliver a payload to a remote host.^[11]

EvilBunny has used WMI to gather information about the system.^[47]

FELIXROOT uses WMI to query the Windows Registry.^[15]

FIN6 has used WMI to automate the remote execution of PowerShell scripts.^[66]

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC during and post compromise cleanup activities.^[59][60]

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.^[44]

Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.^[68]

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).^[21]

HALFBAKED can use WMI queries to gather system information.^[29]

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.^[41]

Impacket's wmiexec module can be used to execute commands through WMI.^[10]

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.^[28]

Kazuar obtains a list of running processes through WMI querying.^[42]

Koadic can use WMI to execute commands.^[7]

KOMPROGO is capable of running WMI queries.^[14]

Lazarus Group malware SierraAlfa uses the Windows Management Instrumentation Command-line application wmic to start itself on a target system during lateral movement.^[62][63]

Leviathan has used WMI for execution.^[56]

MAZE has used "wmic.exe" attempting to delete the shadow volumes on the machine.^[48]

menuPass uses a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.^[50][51]

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.^[38][39]

Mosquito's installer uses WMI to search for antivirus display names.^[13]

MuddyWater has used malware that leveraged WMI for execution and querying host information.^[54][18][55]

Netwalker can use WMI to delete Shadow Volumes.^[49]

NotPetya can use wmic to help propagate itself across a network.^[34][35]

Octopus uses wmic.exe for local discovery information.^[27]

OilRig has used WMI for execution.^[53]

Olympic Destroyer uses WMI to help propagate itself across a network.^[30]

OopsIE uses WMI to perform discovery techniques.^[25]

PoshC2 has a number of modules that use WMI to execute tasks.^[12]

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.^[8][9]

POWERSTATS can use WMI queries to retrieve data from compromised hosts.^[17][18]

POWRUNER may use WMI when collecting information about a victim.^[24]

RATANKBA uses WMI to perform process monitoring.^[22][23]

Remexi executes received commands with wmic.exe (for WMI commands). ^[37]

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.^[19][20]

Soft Cell used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.^[65]

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).^[61]

StoneDrill has used the WMI command-line (WMIC) utility to run tasks.^[43]

A Threat Group-3390 tool can use WMI to execute a binary.^[58]

Ursnif droppers have used WMI classes to execute PowerShell commands.^[45]

WannaCry utilizes wmic to delete shadow copies.^[31][32][33]

Wizard Spider has used WMI and LDAP queries for network discovery.^[69]

One variant of Zebrocy uses WMI queries to gather information.^[40]

Prevent credential overlap across systems of administrator and privileged accounts. ^[5]

By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.