Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › Windows Management Instrumentation (WMI) Execution

Windows Management Instrumentation (WMI) Execution

2 min read

Jump to:

Overview

Windows Management Instrumentation (WMI) Execution is a technique that leverages the WMI infrastructure in Windows operating systems to execute code or commands remotely or locally. It is commonly used by adversaries to perform actions such as executing payloads, gathering information, or moving laterally without relying on traditional execution methods, thereby increasing stealth and persistence throughout the attack lifecycle.

Attack Objective

Execute arbitrary code or commands to gain control or perform reconnaissance
Supports multiple stages including Initial Access, Execution, Persistence, Privilege Escalation, Lateral Movement, and Defense Evasion
Advances attacker position by enabling stealthy and flexible execution capabilities often bypassing traditional security controls

How the Technique Works

WMI provides a standardized interface for management and instrumentation of Windows systems. Adversaries exploit WMI by invoking WMI classes and methods to execute scripts or binaries either locally or on remote systems within the same network. This is achieved through WMI query language (WQL) and scripting interfaces that interact with the WMI repository and services, allowing code execution without creating new processes or files in typical locations.

Common Methods & Variations

Execution of WMI event subscriptions to trigger payloads on system events
Use of WMI command-line tools (e.g., WMIC) or scripting languages (PowerShell, VBScript) to invoke WMI methods
Remote execution via WMI over DCOM or WinRM protocols in on-premises environments
Living-off-the-land approach leveraging built-in Windows components without deploying additional malware

Indicators of Compromise (IOCs)

Unusual WMI event subscription creation or modification
Execution of WMIC or WMI-related scripts outside normal operational patterns
WMI repository anomalies or suspicious WQL queries in event logs
Network traffic consistent with WMI remote calls (DCOM or WinRM)

Detection Strategies

Monitoring Windows Event Logs for WMI activity, especially event IDs related to WMI event subscriptions and executions
Behavioral analysis to identify anomalous use of WMI commands or scripts
Correlation of process creation events with WMI invocation patterns
Network monitoring for unusual DCOM or WinRM traffic indicative of remote WMI execution

Mitigation & Prevention

Restrict and monitor access to WMI namespaces and permissions
Implement application whitelisting to control execution of WMIC and related scripting tools
Enforce least privilege principles on user and service accounts interacting with WMI
Deploy endpoint detection and response solutions capable of identifying WMI misuse

Response Considerations

Immediately disable or remove suspicious WMI event subscriptions
Conduct comprehensive system and network investigations to identify scope of WMI-based execution
Review and harden WMI permissions and audit configurations post-incident
Apply patches and update security policies to prevent recurrence

Related Techniques

Remote Services (e.g., Remote Desktop Protocol, SMB) for lateral movement
Scheduled Task/Job for persistence and execution
PowerShell Execution leveraging scripting for code execution
Process Injection to evade detection during execution

Mapping & References

MITRE ATT&CK: T1047 – Windows Management Instrumentation
MITRE ATT&CK: T1086 – PowerShell (often used in conjunction)
Public research and advisories from cybersecurity vendors and incident reports detailing WMI abuse

Tags: Cyber Attack Techniques Defense Evasion endpoint security lateral movement MITRE ATT&CK persistence Remote Code Execution Threat Detection Windows Security WMI Execution