Procedure examples

Black Basta has used WMI to execute files over the network.

StoneDrill has used the WMI command-line (WMIC) utility to run tasks.

OopsIE uses WMI to perform discovery techniques.

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.

Mosquito's installer uses WMI to search for antivirus display names.

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.

Bazar can execute a WMI query to gather information about the installed antivirus engine.

RATANKBA uses WMI to perform process monitoring.

LockBit 2.0 can use wmic.exe to delete volume shadow copies.

One variant of Zebrocy uses WMI queries to gather information.

Cobalt Strike can use WMI to deliver a payload to a remote host.

SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.

EvilBunny has used WMI to gather information about the system.

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.

AshTag can use a .NET program to execute WMI queries and send unique victim IDs to C2.

FunnyDream can use WMI to open a Windows command shell on a remote machine.

SysUpdate can use WMI for execution on a compromised host.

LAMEHUG can use wmic to collect system information.

FELIXROOT uses WMI to query the Windows Registry.

Meteor can use `wmic.exe` as part of its effort to delete shadow copies.

Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.

LunarWeb can use WMI queries for discovery on the victim host.

Octopus has used wmic.exe for local discovery information.

Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.

Agent Tesla has used wmi queries to gather information from the system.

POWERSTATS can use WMI queries to retrieve data from compromised hosts.

Remexi executes received commands with wmic.exe (for WMI commands).

Astaroth uses WMIC to execute payloads.

QakBot can execute WMI queries to gather information.

jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

INC Ransomware has the ability to use wmic.exe to spread to multiple endpoints within a compromised environment.

FIVEHANDS can use WMI to delete files on a target machine.

HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.

Covenant can utilize WMI to install new Grunt listeners through XSL files or command one-liners.

SILENTTRINITY can use WMI for lateral movement.

PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.

Impacket's `wmiexec` module can be used to execute commands through WMI.

Empire can use WMI to deliver a payload to a remote host.

PoshC2 has a number of modules that use WMI to execute tasks.

Brute Ratel C4 can use WMI to move laterally.

CrackMapExec can execute remote commands using Windows Management Instrumentation.

Koadic can use WMI to execute commands.