Procedure examples

Pysa can perform network reconnaissance using the Advanced Port Scanner tool.

MgBot includes modules for performing HTTP and server service scans.

SpeakUp checks for availability of specific ports on servers.

Cobalt Strike can perform port scans from an infected host.

Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

ZxShell can launch port scans.

Industroyer uses a custom port scanner to map out a network.

HermeticWizard has the ability to scan ports on a compromised network.

SILENTTRINITY can scan for open ports on a compromised machine.

Empire can perform port scans from an infected host.

As part of load balancing FRP can set `healthCheck.type = "tcp"` or `healthCheck.type = "http"` to check service status on specific hosts with TCPing or an HTTP request.

PoshC2 can perform port scans from an infected host.

Brute Ratel C4 can conduct port scanning against targeted systems.

Peirates can initiate a port scan against a given IP address.

NBTscan can be used to scan IP networks.

Koadic can scan for open TCP ports on the target network.

Pupy has a built-in module for port scanning.

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.

During SharePoint ToolShell Exploitation, threat actors used WMI for execution.

During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.

During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method.

During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.

During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.

During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT.

During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.

During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.

During Operation Wocao, threat actors has used WMI to execute commands.

During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.

Indrik Spider has used WMIC to execute commands on remote computers.

BlackByte used WMI to delete Volume Shadow Copies on victim machines.

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.

MuddyWater has used malware that leveraged WMI for execution and querying host information.

Naikon has used WMIC.exe for lateral movement.

FIN6 has used WMI to automate the remote execution of PowerShell scripts.

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.

FIN7 has used WMI to install malware on targeted systems.

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.

Mustang Panda has executed PowerShell scripts via WMI.

TA2541 has used WMI to query targeted systems for security products.

OilRig has used WMI for execution.

Aquatic Panda used WMI for lateral movement in victim environments.

Leviathan has used WMI for execution.

Blue Mockingbird has used wmic.exe to set environment variables.

Lotus Blossom has used WMI to enable lateral movement.

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).