Procedure examples

APT29 used WMI to steal credentials and execute backdoors at a future time.

Cinnamon Tempest has used Impacket for lateral movement via WMI.

Chimera has used WMIC to execute remote commands.

MirrorFace has leveraged WMIC on targeted systems post compromise.

Medusa Group has utilized Windows Management Instrumentation to query system information.

The Deep Panda group is known to utilize WMI for lateral movement.

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.

Windshift has used WMI to collect information about target machines.

ToddyCat has used WMI to execute scripts for post exploit document collection.

APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.

APT-C-36 has used WMI to execute PowerShell.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

INC Ransom has used WMIC to deploy ransomware.

Earth Lusca used a VBA script to execute WMI.

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.

Velvet Ant used the `wmiexec.py` tool within Impacket for remote process execution via WMI.

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.

Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.

A Threat Group-3390 tool can use WMI to execute a binary.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

FIN13 has utilized `WMI` to execute commands and move laterally on compromised Windows machines.

EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.

Bumblebee can use WMI to gather system information and to spawn processes for code injection.

Stuxnet used WMI with an explorer.exe token to execute on a remote share.

POWRUNER may use WMI when collecting information about a victim.

SharpStage can use WMI for execution.

Sardonic can use WMI to execute PowerShell commands on a compromised machine.

HALFBAKED can use WMI queries to gather system information.

TAMECAT has used Windows Management Instrumentation (WMI) to query anti-virus products.

Ursnif droppers have used WMI classes to execute PowerShell commands.

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).

ROAMINGHOUSE can use WMI to launch a legitimate executable later used to enable DLL sideloading.

TONESHELL has used WMI queries to gather information from the system.

PyDCrypt has attempted to execute with WMIC.

IMAPLoader uses WMI queries to query system information on victim hosts.

Emotet has used WMI to execute powershell.exe.

Olympic Destroyer uses WMI to help propagate itself across a network.

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.

Action RAT can use WMI to gather AV products installed on an infected host.

PUBLOAD has used `wmic` to gather information from the victim device.

ShrinkLocker uses WMI to query information about the victim operating system.

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.

Snip3 can query the WMI class `Win32_ComputerSystem` to gather information.

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.

ProLock can use WMIC to execute scripts on targeted hosts.

Raspberry Robin can execute via LNK containing a command to run a legitimate executable, such as wmic.exe, to download a malicious Windows Installer (MSI) package.

BlackCat can use `wmic.exe` to delete shadow copies on compromised networks.

IcedID has used WMI to execute binaries.

Kazuar obtains a list of running processes through WMI querying.

Lucifer can use WMI to log into remote machines for propagation.