T1047 Windows Management Instrumentation

About this technique

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.

The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management. Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.

An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as Execution of commands and payloads. For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., Inhibit System Recovery).

**Note:** `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by PowerShell as the primary WMI interface. In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.

Detection rules69

Rules on DetectionCode tagged with T1047.

Sigma48

Rule	Level	Log source
Wmiexec Default Output File	critical	windows / file_event
Wmiprvse Wbemcomn DLL Hijack - File	critical	windows / file_event
Blue Mockingbird - Registry	high	windows / registry_set
HackTool - CrackMapExec Execution	high	windows / process_creation
HackTool - CrackMapExec Execution Patterns	high	windows / process_creation
HackTool - Potential Impacket Lateral Movement Activity	high	windows / process_creation
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation
Potential Remote SquiblyTwo Technique Execution	high	windows / process_creation
Potential Windows Defender Tampering Via Wmic.EXE	high	windows / process_creation
PSExec and WMI Process Creations Block	high	windows / NULL
Remote DCOM/WMI Lateral Movement	high	rpc_firewall / application
Script Event Consumer Spawning Process	high	windows / process_creation
Suspicious Autorun Registry Modified via WMI	high	windows / process_creation
Suspicious Encoded Scripts in a WMI Consumer	high	windows / wmi_event
Suspicious HH.EXE Execution	high	windows / process_creation
Suspicious Microsoft Office Child Process	high	windows / process_creation
Suspicious Process Created Via Wmic.EXE	high	windows / process_creation
Suspicious WMIC Execution Via Office Process	high	windows / process_creation
Suspicious WmiPrvSE Child Process	high	windows / process_creation
T1047 Wmiprvse Wbemcomn DLL Hijack	high	windows / NULL
WMImplant Hack Tool	high	windows / ps_script
Wmiprvse Wbemcomn DLL Hijack	high	windows / image_load
Application Removed Via Wmic.EXE	medium	windows / process_creation
Application Termination Attempt via Wmic.EXE	medium	windows / process_creation
Computer System Reconnaissance Via Wmic.EXE	medium	windows / process_creation
Hardware Model Reconnaissance Via Wmic.EXE	medium	windows / process_creation
MITRE BZAR Indicators for Execution	medium	zeek / NULL
Password Set to Never Expire via WMI	medium	windows / process_creation
Potential Process Reconnaissance via Wmic.EXE	medium	windows / process_creation
Potential Product Class Reconnaissance Via Wmic.EXE	medium	windows / process_creation
Potential Product Reconnaissance Via Wmic.EXE	medium	windows / process_creation
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE	medium	windows / process_creation
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell	medium	windows / process_creation
Process Creation Attempt via Wmic.EXE	medium	windows / process_creation
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class	medium	windows / process_creation
Registry Enumeration via WMI Stdregprov	medium	windows / process_creation
Registry Manipulation via WMI Stdregprov	medium	windows / process_creation
Service Reconnaissance Via Wmic.EXE	medium	windows / process_creation
Service Started/Stopped Via Wmic.EXE	medium	windows / process_creation
Service Startup Type Change Via Wmic.EXE	medium	windows / process_creation
System Disk And Volume Reconnaissance Via Wmic.EXE	medium	windows / process_creation
Windows Hotfix Updates Reconnaissance Via Wmic.EXE	medium	windows / process_creation
WMI Event Consumer Created Named Pipe	medium	windows / pipe_created
WMIC Remote Command Execution	medium	windows / process_creation
WMIC Unquoted Services Path Lookup - PowerShell	medium	windows / ps_script
WmiPrvSE Spawned A Process	medium	windows / process_creation
XSL Script Execution Via WMIC.EXE	medium	windows / process_creation
Successful Account Login Via WMI	low	windows / NULL

Splunk21

Rule	Type	Risk	Data source
Impacket Lateral Movement Commandline Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Impacket Lateral Movement smbexec CommandLine Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Impacket Lateral Movement WMIExec Commandline Parameters	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2
PowerShell Invoke CIMMethod CIMSession	Anomaly	NULL	Powershell Script Block Logging 4104
PowerShell Invoke WmiExec Usage	TTP	NULL	Powershell Script Block Logging 4104
Process Execution via WMI	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Remote Process Instantiation via WMI	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Remote Process Instantiation via WMI and PowerShell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Remote Process Instantiation via WMI and PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104
Remote WMI Command Attempt	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Script Execution via WMI	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows WinRAR Launched Outside Default Installation Directory	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows WMI Impersonate Token	Anomaly	NULL	Sysmon EventID 10
Windows WMI Process And Service List	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows WMI Process Call Create	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Windows WMI Reconnaissance Class Query	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
WMI Permanent Event Subscription	TTP	NULL
WMI Temporary Event Subscription	TTP	NULL
Wmiprsve LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2
Wmiprvse LOLBAS Execution Process Spawn	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

Groups42

Show 18 more

Magic Hound Medusa Group menuPass MirrorFace MuddyWater Mustang Panda Naikon OilRig Sandworm Team Stealth Falcon TA2541 Threat Group-3390 ToddyCat Velvet Ant VOID MANTICORE Volt Typhoon Windshift Wizard Spider

Software93

Show 69 more

Campaigns12

2016 Ukraine Electric Power Attack C0015 C0018 C0027 Frankenstein FunnyDream HomeLand Justice Operation AkaiRyū Operation Dream Job Operation Wocao SharePoint ToolShell Exploitation SolarWinds Compromise

Procedure examples147

Groups42

Used by	Procedure example
GroupAPT-C-36	APT-C-36 has used WMI to execute PowerShell. Zscaler BlindEagle DEC 2025
GroupAPT29	APT29 used WMI to steal credentials and execute backdoors at a future time. Mandiant No Easy Breach
GroupAPT32	APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process. Cybereason Cobalt Kitty 2017
GroupAPT41	APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI). FireEye APT41 Aug 2019 Group IB APT 41 June 2021 apt41_dcsocytec_dec2022
GroupAPT42	APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products. Mandiant APT42-untangling
GroupAquatic Panda	Aquatic Panda used WMI for lateral movement in victim environments. Crowdstrike HuntReport 2022
GroupBlackByte	BlackByte used WMI to delete Volume Shadow Copies on victim machines. FBI BlackByte 2022
GroupBlue Mockingbird	Blue Mockingbird has used wmic.exe to set environment variables. RedCanary Mockingbird May 2020

View all 42 groups examples

Software93

Used by	Procedure example
MalwareAction RAT	Action RAT can use WMI to gather AV products installed on an infected host. MalwareBytes SideCopy Dec 2021
MalwareAgent Tesla	Agent Tesla has used wmi queries to gather information from the system. Bitdefender Agent Tesla April 2020
MalwareAkira	Akira will leverage COM objects accessed through WMI during execution to evade detection. Kersten Akira 2023
MalwareAshTag	AshTag can use a .NET program to execute WMI queries and send unique victim IDs to C2. Palo Alto Ashen Lepus DEC 2025
MalwareAstaroth	Astaroth uses WMIC to execute payloads. Cofense Astaroth Sept 2018
MalwareAvaddon	Avaddon uses wmic.exe to delete shadow copies. Hornet Security Avaddon June 2020
MalwareBADHATCH	BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine. BitDefender BADHATCH Mar 2021 Gigamon BADHATCH Jul 2019
MalwareBazar	Bazar can execute a WMI query to gather information about the installed antivirus engine. Cybereason Bazar July 2020 DFIR Ryuk's Return October 2020

View all 93 software examples

Campaigns12

Used by	Procedure example
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys. Dragos Crashoverride 2018
CampaignC0015	During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host. DFIR Conti Bazar Nov 2021
CampaignC0018	During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (`wmiprvse.exe`) to execute a variety of encoded PowerShell scripts using the `DownloadString` method. Cisco Talos Avos Jun 2022 Costa AvosLocker May 2022
CampaignC0027	During C0027, Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket. Crowdstrike TELCO BPO Campaign December 2022
CampaignFrankenstein	During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version. Talos Frankenstein June 2019
CampaignFunnyDream	During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands. Bitdefender FunnyDream Campaign November 2020
CampaignHomeLand Justice	During HomeLand Justice, threat actors used WMI to modify Windows Defender settings. Microsoft Albanian Government Attacks September 2022
CampaignOperation AkaiRyū	During Operation AkaiRyū, MirrorFace used WMI to proxy execution of UPPERCUT. ESET MirrorFace 2025

View all 12 campaigns examples

References4

Mandiant WMI Open source
Mandiant. (n.d.). Retrieved February 13, 2024.
WMI 1-3 Open source
Microsoft. (2023, March 7). Retrieved February 13, 2024.
WMI 6 Open source
Microsoft. (2022, June 13). BlackCat. Retrieved February 13, 2024.
WMI 7,8 Open source
Microsoft. (2024, January 26). WMIC Deprecation. Retrieved February 13, 2024.