LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Mofcomp.exe

View source

Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1047

Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository

COMMAND
mofcomp.exe {PATH_ABSOLUTE:.mof}
USE CASE
Threat actors can use mofcomp.exe to register a malicious MOF file as a new class in the WMI repository
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server 2008+
Execute · MOF
02 / ON DISK

Known paths

C:\Windows\System32\wbem\mofcomp.exe
C:\Windows\SysWOW64\wbem\mofcomp.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    strange parent processes spawning mofcomp.exe like cmd.exe or powershell.exe

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Daniel Gott@gott_cyber
The DFIR Report@TheDFIRReport
Nasreddine Bencherchali@nas_bench