Procedure examples

Lucifer can use WMI to log into remote machines for propagation.

A BlackEnergy 2 plug-in uses WMI to gather victim host details.

NotPetya can use wmic to help propagate itself across a network.

Avaddon uses wmic.exe to delete shadow copies.

SocGholish has used WMI calls for script execution and system profiling.

HELLOKITTY can use WMI to delete volume shadow copies.

DarkTortilla can use WMI queries to obtain system information.

DarkWatchman can use WMI to execute commands.

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.

DEATHRANSOM has the ability to use WMI to delete volume shadow copies.

Akira will leverage COM objects accessed through WMI during execution to evade detection.

DarkGate has used WMI to execute files over the network and to obtain information about the domain.

SVCReady can use `WMI` queries to detect the presence of a virtual machine environment.

Netwalker can use WMI to delete Shadow Volumes.

WannaCry utilizes wmic to delete shadow copies.

Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.

LODEINFO can execute commands with WMI.

CharmPower can use `wmic` to gather information from a system.

EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.

KOMPROGO is capable of running WMI queries.

MoleNet can perform WMI commands on the system.

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.

Black Basta has used WMI to execute files over the network.

StoneDrill has used the WMI command-line (WMIC) utility to run tasks.

OopsIE uses WMI to perform discovery techniques.

RogueRobin uses various WMI queries to check if the sample is running in a sandbox.

Mosquito's installer uses WMI to search for antivirus display names.

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.

Bazar can execute a WMI query to gather information about the installed antivirus engine.

RATANKBA uses WMI to perform process monitoring.

LockBit 2.0 can use wmic.exe to delete volume shadow copies.

One variant of Zebrocy uses WMI queries to gather information.

Cobalt Strike can use WMI to deliver a payload to a remote host.

SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.

EvilBunny has used WMI to gather information about the system.

REvil can use WMI to monitor for and kill specific processes listed in its configuration file.

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.

AshTag can use a .NET program to execute WMI queries and send unique victim IDs to C2.

FunnyDream can use WMI to open a Windows command shell on a remote machine.

SysUpdate can use WMI for execution on a compromised host.

LAMEHUG can use wmic to collect system information.

FELIXROOT uses WMI to query the Windows Registry.

Meteor can use `wmic.exe` as part of its effort to delete shadow copies.

Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.

LunarWeb can use WMI queries for discovery on the victim host.

Octopus has used wmic.exe for local discovery information.

Qilin can use WMIC to change the Volume Shadow Copy Service (VSS) startup type to manual.

Agent Tesla has used wmi queries to gather information from the system.

POWERSTATS can use WMI queries to retrieve data from compromised hosts.

Remexi executes received commands with wmic.exe (for WMI commands).