Procedure examples

FIN6 has used WMI to automate the remote execution of PowerShell scripts.

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.

FIN7 has used WMI to install malware on targeted systems.

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.

Mustang Panda has executed PowerShell scripts via WMI.

TA2541 has used WMI to query targeted systems for security products.

OilRig has used WMI for execution.

Aquatic Panda used WMI for lateral movement in victim environments.

Leviathan has used WMI for execution.

Blue Mockingbird has used wmic.exe to set environment variables.

Lotus Blossom has used WMI to enable lateral movement.

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).

APT29 used WMI to steal credentials and execute backdoors at a future time.

Cinnamon Tempest has used Impacket for lateral movement via WMI.

Chimera has used WMIC to execute remote commands.

MirrorFace has leveraged WMIC on targeted systems post compromise.

Medusa Group has utilized Windows Management Instrumentation to query system information.

The Deep Panda group is known to utilize WMI for lateral movement.

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.

Windshift has used WMI to collect information about target machines.

ToddyCat has used WMI to execute scripts for post exploit document collection.

APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.

APT-C-36 has used WMI to execute PowerShell.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

INC Ransom has used WMIC to deploy ransomware.

Earth Lusca used a VBA script to execute WMI.

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.

Velvet Ant used the `wmiexec.py` tool within Impacket for remote process execution via WMI.

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.

Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.

A Threat Group-3390 tool can use WMI to execute a binary.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

FIN13 has utilized `WMI` to execute commands and move laterally on compromised Windows machines.

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.

Play has used WinSCP to exfiltrate data to actor-controlled accounts.

Storm-1811 has exfiltrated captured user credentials via Secure Copy Protocol (SCP).

CURIUM has used SMTPS to exfiltrate collected data from victims.

MirrorFace has used Secure File Transfer Protocol (SFTP) for file exfiltration.

APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.

Salt Typhoon has exfiltrated configuration files from exploited network devices over FTP and TFTP.

APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.

Mustang Panda has used FTP to exfiltrate archive files.

Contagious Interview has exfiltrated victim information using FTP.

OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS.

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.

Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.

Wizard Spider has exfiltrated victim information using FTP.

APT33 has used FTP to exfiltrate files (separately from the C2 channel).

FIN8 has used FTP to exfiltrate collected data.