Procedure examples

During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.

During SharePoint ToolShell Exploitation, threat actors used WMI for execution.

During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.

During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method.

During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.

During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.

During the SolarWinds Compromise, APT29 used WMI for the remote execution of files for lateral movement.

During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT.

During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.

During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.

During Operation Wocao, threat actors has used WMI to execute commands.

During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.