Description
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.
The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management.(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Citation: Mandiant WMI)
An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as Execution of commands and payloads.(Citation: Mandiant WMI) For example, wmic.exe can be abused by an adversary to delete shadow copies with the command wmic.exe Shadowcopy Delete (i.e., Inhibit System Recovery).(Citation: WMI 6)
Note: wmic.exe is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by PowerShell as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like wbemtool.exe, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8)
Platforms
Mitigations (4)
Execution PreventionM1038
Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries. For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.(Citation: Microsoft WD
Behavior Prevention on EndpointM1040
On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running. Note: many legitimate tools and applications utilize WMI for command execution. (Citation: win10_asr)
User Account ManagementM1018
By default, only administrators are allowed to connect remotely using WMI. Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.
Privileged Account ManagementM1026
Prevent credential overlap across systems of administrator and privileged accounts. (Citation: FireEye WMI 2015)
Threat Groups (42)
| ID | Group | Context |
|---|---|---|
| G0119 | Indrik Spider | [Indrik Spider](https://attack.mitre.org/groups/G0119) has used WMIC to execute commands on remote computers.(Citation: Symantec WastedLocker June 202... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) used WMI to delete Volume Shadow Copies on victim machines.(Citation: FBI BlackByte 2022) |
| G0093 | GALLIUM | [GALLIUM](https://attack.mitre.org/groups/G0093) used WMI for execution to assist in lateral movement as well as for installing tools across multiple ... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has leveraged WMIC for execution, remote system discovery, and to create and use temporary direc... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence vi... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050) used WMI to deploy their tools on remote machines and to gather information about the Outlook process.(... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that leveraged WMI for execution and querying host information.(Citation: Securel... |
| G0019 | Naikon | [Naikon](https://attack.mitre.org/groups/G0019) has used WMIC.exe for lateral movement.(Citation: Bitdefender Naikon April 2021) |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has used WMI to automate the remote execution of PowerShell scripts.(Citation: Security Intelligence Mor... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) has used WMI to execute scripts used for discovery and for determining the C2 IP address.(Cit... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used WMI to install malware on targeted systems.(Citation: eSentire FIN7 July 2021) |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used [Impacket](https://attack.mitre.org/software/S0357)’s WMIexec module for remote code e... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has executed PowerShell scripts via WMI.(Citation: Anomali MUSTANG PANDA October 2019)(Citation... |
| G1018 | TA2541 | [TA2541](https://attack.mitre.org/groups/G1018) has used WMI to query targeted systems for security products.(Citation: Proofpoint TA2541 February 202... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has used WMI for execution.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Symantec Crambus OCT 2... |
| G0143 | Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) used WMI for lateral movement in victim environments.(Citation: Crowdstrike HuntReport 2022) |
| G0065 | Leviathan | [Leviathan](https://attack.mitre.org/groups/G0065) has used WMI for execution.(Citation: Proofpoint Leviathan Oct 2017) |
| G0108 | Blue Mockingbird | [Blue Mockingbird](https://attack.mitre.org/groups/G0108) has used wmic.exe to set environment variables.(Citation: RedCanary Mockingbird May 2020) |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used WMI to enable lateral movement.(Citation: Cisco LotusBlossom 2025) |
Associated Software (93)
| ID | Name | Type | Context |
|---|---|---|---|
| S0605 | EKANS | Malware | [EKANS](https://attack.mitre.org/software/S0605) can use Windows Mangement Instrumentation (WMI) calls to execute operations.(Citation: Dragos EKANS) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can use WMI to gather system information and to spawn processes for code injection.(Citation: Goo... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) used WMI with an <code>explorer.exe</code> token to execute on a remote share.(Citation: Nicolas Fa... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may use WMI when collecting information about a victim.(Citation: FireEye APT34 Dec 2017) |
| S0546 | SharpStage | Malware | [SharpStage](https://attack.mitre.org/software/S0546) can use WMI for execution.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Mo... |
| S1085 | Sardonic | Malware | [Sardonic](https://attack.mitre.org/software/S1085) can use WMI to execute PowerShell commands on a compromised machine.(Citation: Bitdefender Sardoni... |
| S0151 | HALFBAKED | Malware | [HALFBAKED](https://attack.mitre.org/software/S0151) can use WMI queries to gather system information.(Citation: FireEye FIN7 April 2017) |
| S1193 | TAMECAT | Malware | [TAMECAT](https://attack.mitre.org/software/S1193) has used Windows Management Instrumentation (WMI) to query anti-virus products.(Citation: Mandiant ... |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) droppers have used WMI classes to execute [PowerShell](https://attack.mitre.org/techniques/T1059/001... |
| S0237 | GravityRAT | Malware | [GravityRAT](https://attack.mitre.org/software/S0237) collects various information via WMI requests, including CPU information in the Win32_Processor ... |
| S9026 | ROAMINGHOUSE | Malware | [ROAMINGHOUSE](https://attack.mitre.org/software/S9026) can use WMI to launch a legitimate executable later used to enable DLL sideloading.(Citation: ... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has used WMI queries to gather information from the system.(Citation: ATTACKIQ MUSTANG PANDA TONE... |
| S1032 | PyDCrypt | Malware | [PyDCrypt](https://attack.mitre.org/software/S1032) has attempted to execute with WMIC.(Citation: Checkpoint MosesStaff Nov 2021) |
| S1152 | IMAPLoader | Malware | [IMAPLoader](https://attack.mitre.org/software/S1152) uses WMI queries to query system information on victim hosts.(Citation: PWC Yellow Liderc 2023) |
| S0367 | Emotet | Malware | [Emotet](https://attack.mitre.org/software/S0367) has used WMI to execute powershell.exe.(Citation: Carbon Black Emotet Apr 2019) |
| S0365 | Olympic Destroyer | Malware | [Olympic Destroyer](https://attack.mitre.org/software/S0365) uses WMI to help propagate itself across a network.(Citation: Talos Olympic Destroyer 201... |
| S1081 | BADHATCH | Malware | [BADHATCH](https://attack.mitre.org/software/S1081) can utilize WMI to collect system information, create new processes, and run malicious PowerShell ... |
| S1028 | Action RAT | Malware | [Action RAT](https://attack.mitre.org/software/S1028) can use WMI to gather AV products installed on an infected host.(Citation: MalwareBytes SideCopy... |
| S1228 | PUBLOAD | Malware | [PUBLOAD](https://attack.mitre.org/software/S1228) has used `wmic` to gather information from the victim device.(Citation: Trend Micro MUSTANG PANDA P... |
| S1178 | ShrinkLocker | Malware | [ShrinkLocker](https://attack.mitre.org/software/S1178) uses WMI to query information about the victim operating system.(Citation: Kaspersky ShrinkLoc... |
References
- Ballenthin, W., et al. (2015). Windows Management Instrumentation (WMI) Offense, Defense, and Forensics. Retrieved March 30, 2016.
- Mandiant. (n.d.). Retrieved February 13, 2024.
- Microsoft. (2022, June 13). BlackCat. Retrieved February 13, 2024.
- Microsoft. (2023, March 7). Retrieved February 13, 2024.
- Microsoft. (2024, January 26). WMIC Deprecation. Retrieved February 13, 2024.
Frequently Asked Questions
What is T1047 (Windows Management Instrumentation)?
T1047 is a MITRE ATT&CK technique named 'Windows Management Instrumentation'. It belongs to the Execution tactic(s). Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations...
How can T1047 be detected?
Detection of T1047 (Windows Management Instrumentation) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1047?
There are 4 documented mitigations for T1047. Key mitigations include: Execution Prevention, Behavior Prevention on Endpoint, User Account Management, Privileged Account Management.
Which threat groups use T1047?
Known threat groups using T1047 include: Indrik Spider, BlackByte, GALLIUM, Volt Typhoon, APT41, menuPass, APT32, MuddyWater.