Procedure examples

EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.

Bumblebee can use WMI to gather system information and to spawn processes for code injection.

Stuxnet used WMI with an explorer.exe token to execute on a remote share.

POWRUNER may use WMI when collecting information about a victim.

SharpStage can use WMI for execution.

Sardonic can use WMI to execute PowerShell commands on a compromised machine.

HALFBAKED can use WMI queries to gather system information.

TAMECAT has used Windows Management Instrumentation (WMI) to query anti-virus products.

Ursnif droppers have used WMI classes to execute PowerShell commands.

GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).

ROAMINGHOUSE can use WMI to launch a legitimate executable later used to enable DLL sideloading.

TONESHELL has used WMI queries to gather information from the system.

PyDCrypt has attempted to execute with WMIC.

IMAPLoader uses WMI queries to query system information on victim hosts.

Emotet has used WMI to execute powershell.exe.

Olympic Destroyer uses WMI to help propagate itself across a network.

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.

Action RAT can use WMI to gather AV products installed on an infected host.

PUBLOAD has used `wmic` to gather information from the victim device.

ShrinkLocker uses WMI to query information about the victim operating system.

FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.

Snip3 can query the WMI class `Win32_ComputerSystem` to gather information.

HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.

ProLock can use WMIC to execute scripts on targeted hosts.

Raspberry Robin can execute via LNK containing a command to run a legitimate executable, such as wmic.exe, to download a malicious Windows Installer (MSI) package.

BlackCat can use `wmic.exe` to delete shadow copies on compromised networks.

IcedID has used WMI to execute binaries.

Kazuar obtains a list of running processes through WMI querying.

Lucifer can use WMI to log into remote machines for propagation.

A BlackEnergy 2 plug-in uses WMI to gather victim host details.

NotPetya can use wmic to help propagate itself across a network.

Avaddon uses wmic.exe to delete shadow copies.

SocGholish has used WMI calls for script execution and system profiling.

HELLOKITTY can use WMI to delete volume shadow copies.

DarkTortilla can use WMI queries to obtain system information.

DarkWatchman can use WMI to execute commands.

The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.

DEATHRANSOM has the ability to use WMI to delete volume shadow copies.

Akira will leverage COM objects accessed through WMI during execution to evade detection.

DarkGate has used WMI to execute files over the network and to obtain information about the domain.

SVCReady can use `WMI` queries to detect the presence of a virtual machine environment.

Netwalker can use WMI to delete Shadow Volumes.

WannaCry utilizes wmic to delete shadow copies.

Latrodectus has used WMI in malicious email infection chains to facilitate the installation of remotely-hosted files.

LODEINFO can execute commands with WMI.

CharmPower can use `wmic` to gather information from a system.

EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.

KOMPROGO is capable of running WMI queries.

MoleNet can perform WMI commands on the system.

Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.