Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › WMI-Based Lateral Movement

WMI-Based Lateral Movement

2 min read

Jump to:

Overview

WMI-Based Lateral Movement is a technique where adversaries leverage Windows Management Instrumentation (WMI) to move laterally across systems within a network. This method enables attackers to execute commands or scripts remotely without deploying additional malware, facilitating stealthy propagation during the attack lifecycle. Adversaries use WMI for its native presence and powerful remote management capabilities to evade detection and maintain persistence.

Attack Objective

Gain remote execution and control over additional systems
Lateral Movement stage within the attack lifecycle
Expand access and privileges across the network to increase foothold and facilitate further exploitation

How the Technique Works

Adversaries utilize WMI’s remote execution features to run commands or scripts on target machines by querying or invoking WMI classes and methods. This can include executing payloads, gathering system information, or modifying configurations. Because WMI is a legitimate management framework, its use can blend with normal administrative activity, complicating detection efforts.

Common Methods & Variations

Executing WMI event subscriptions to trigger payloads on remote hosts
Using WMI command-line tools or scripting interfaces such as PowerShell or WMIC
On-premises environments primarily, but also applicable in hybrid cloud setups with Windows-based endpoints
Predominantly living-off-the-land techniques leveraging built-in Windows tools rather than deploying custom malware

Indicators of Compromise (IOCs)

Unusual WMI event subscription creation or modification logs
Remote WMI execution events in Windows event logs (e.g., Event ID 5858, 5861)
Unexpected network connections associated with WMI traffic (typically over DCOM or WMI-specific ports)
Execution of uncommon or suspicious WMI queries or scripts on endpoints

Detection Strategies

Collect and analyze Windows event logs related to WMI activity and remote executions
Behavioral detection focusing on anomalous WMI usage patterns, such as unusual event subscription creation or remote command execution
Correlation of network traffic with WMI-related protocols and endpoint telemetry to identify lateral movement attempts

Mitigation & Prevention

Restrict and monitor WMI permissions and access controls to limit remote execution capabilities
Implement network segmentation and firewall rules to control WMI traffic between systems
Enforce least privilege principles for user and service accounts interacting with WMI
Apply endpoint protection solutions that monitor and alert on suspicious WMI activity

Response Considerations

Immediately isolate affected systems to prevent further lateral movement
Investigate WMI event logs and network connections to identify scope and timeline of compromise
Remove unauthorized WMI event subscriptions and scripts
Review and harden WMI access permissions and audit policies post-incident

Related Techniques

Remote Services (e.g., SMB, RDP) for lateral movement
Windows Remote Management (WinRM) for remote execution
Process Injection and Command and Scripting Interpreter techniques used in conjunction with WMI

Mapping & References

MITRE ATT&CK Tactic: Lateral Movement
MITRE ATT&CK Technique: T1047 – Windows Management Instrumentation
Public research and advisories on WMI abuse in lateral movement scenarios from cybersecurity vendors and incident reports

Tags: Cyber Defense endpoint security Incident Response lateral movement MITRE ATT&CK network security Remote Execution Threat Detection Windows Security WMI