MITRE ATT&CKtechnique

T1047 Windows Management Instrumentation

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows
Version
1.6
Created
2017-05-31

Description

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management. Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS. An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as Execution of commands and payloads. For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., Inhibit System Recovery). Note: `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by PowerShell as the primary WMI interface. In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M1038 Execution Prevention mitigation
  • M1040 Behavior Prevention on Endpoint mitigation
  • M1018 User Account Management mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (149)

  • G1059 NIMBUS MANTICORE group
  • S9051 The Gentlemen Ransomware software (malware)
  • S9035 LAMEHUG software (malware)
  • G1055 VOID MANTICORE group
  • S9031 AshTag software (malware)
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9026 ROAMINGHOUSE software (malware)
  • C0058 SharePoint ToolShell Exploitation campaign
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • S1228 PUBLOAD software (malware)
  • G1047 Velvet Ant group
  • S1199 LockBit 2.0 software (malware)
  • G1044 APT42 group
  • S1193 TAMECAT software (malware)
  • G1043 BlackByte group
  • S1178 ShrinkLocker software (malware)
  • S1160 Latrodectus software (malware)
  • S1155 Covenant software (tool)
  • S1152 IMAPLoader software (malware)
  • C0038 HomeLand Justice campaign
  • S1141 LunarWeb software (malware)
  • G1032 INC Ransom group
  • S1139 INC Ransomware software (malware)
  • S1130 Raspberry Robin software (malware)
  • S1129 Akira software (malware)
  • S1124 SocGholish software (malware)
Show all 149 ›

Referenced by Compliance · mitigates (20)

  • CIS-13.7 Deploy a Host-Based Intrusion Prevention Solution CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SC-3 Security Function Isolation NIST 800-53 control
  • NIST-SI-16 Memory Protection NIST 800-53 control
  • NIST-SI-2 Flaw Remediation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References