Procedure examples

Indrik Spider has used WMIC to execute commands on remote computers.

BlackByte used WMI to delete Volume Shadow Copies on victim machines.

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.

Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.

MuddyWater has used malware that leveraged WMI for execution and querying host information.

Naikon has used WMIC.exe for lateral movement.

FIN6 has used WMI to automate the remote execution of PowerShell scripts.

Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: `Select * From Win32_PingStatus where Address = 'mil.gov.ua'`.

FIN7 has used WMI to install malware on targeted systems.

Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.

Mustang Panda has executed PowerShell scripts via WMI.

TA2541 has used WMI to query targeted systems for security products.

OilRig has used WMI for execution.

Aquatic Panda used WMI for lateral movement in victim environments.

Leviathan has used WMI for execution.

Blue Mockingbird has used wmic.exe to set environment variables.

Lotus Blossom has used WMI to enable lateral movement.

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).

APT29 used WMI to steal credentials and execute backdoors at a future time.

Cinnamon Tempest has used Impacket for lateral movement via WMI.

Chimera has used WMIC to execute remote commands.

MirrorFace has leveraged WMIC on targeted systems post compromise.

Medusa Group has utilized Windows Management Instrumentation to query system information.

The Deep Panda group is known to utilize WMI for lateral movement.

Ember Bear has used WMI execution with password hashes for command execution and lateral movement.

Windshift has used WMI to collect information about target machines.

ToddyCat has used WMI to execute scripts for post exploit document collection.

APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.

APT-C-36 has used WMI to execute PowerShell.

Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

INC Ransom has used WMIC to deploy ransomware.

Earth Lusca used a VBA script to execute WMI.

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.

Velvet Ant used the `wmiexec.py` tool within Impacket for remote process execution via WMI.

VOID MANTICORE has utilized WMIC to log into the victim host and create a process `process call create “cmd.exe /c copy \\?\\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\windows\system32\config\system c:\users\public”`.

Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.

A Threat Group-3390 tool can use WMI to execute a binary.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

FIN13 has utilized `WMI` to execute commands and move laterally on compromised Windows machines.