Full Report
Actionable insights on hunting for Windows Management Instrumentation (WMI) execution abuse
Analysis Summary
# Tool/Technique: WMI Execution Abuse
## Overview
Windows Management Instrumentation (WMI) is a core Windows administration feature that provides a standardized interface for managing data and operations. Threat actors abuse WMI to execute commands, move laterally across a network, or establish persistence. Because WMI is a legitimate system component, its abuse often blends in with normal administrative activity, making it a "living-off-the-land" (LotL) favorite for attackers.
## Technical Details
- **Type**: Technique
- **Platform**: Windows
- **Capabilities**: Remote command execution, persistence, reconnaissance, and lateral movement.
- **First Seen**: WMI has been a standard part of Windows since Windows 2000; abuse has been documented for over a decade.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- **T1047 - Windows Management Instrumentation**
- **TA0003 - Persistence**
- **T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription**
- **TA0008 - Lateral Movement**
- **T1021.006 - Remote Services: Windows Management Instrumentation**
## Functionality
### Core Capabilities
- **Local/Remote Execution**: Attackers can spawn processes on local or remote systems via the `Win32_Process` class and its `Create` method.
- **System Information Gathering**: Querying system details, installed software, and running processes.
- **Asynchronous Execution**: Running tasks without requiring an active interactive session.
### Advanced Features
- **WMI Event Subscriptions**: Creating "Event Filters," "Event Consumers," and "Filter To Consumer Bindings" to trigger malicious code execution upon specific system events (e.g., system uptime, user login), providing stealthy persistence.
- **Fileless Execution**: Executing scripts or commands directly in memory through WMI consumers (like `ActiveScriptEventConsumer`) without dropping files to disk.
## Indicators of Compromise
- **File Names**: `WmiPrvSe.exe` (WMI Provider Host), `wmiprvse.exe`.
- **Behavioral Indicators**:
- `WmiPrvSe.exe` acting as a parent process to suspicious children like `cmd.exe`, `powershell.exe`, `scrcons.exe`, or `cscript.exe`.
- Unexpected network connections from `wmiprvse.exe` (indicative of remote WMI usage).
- High frequency of WMI queries from a single source to multiple endpoints.
- Creation of new WMI Event Filters or Consumers in the `ROOT\subscription` namespace.
## Associated Threat Actors
- **APT29 (Cozy Bear)**
- **APT28 (Fancy Bear)**
- **Lazarus Group**
- **FIN7**
- **Various Ransomware Operators** (used for lateral movement and disabling security software).
## Detection Methods
- **Behavioral Detection**:
- Monitor for `WmiPrvSe.exe` spawning shells or scripting engines.
- Query: `event_type: "Process creation" AND ParentImageFileName: "*\\wmiprvse.exe"`.
- **User Context Analysis**: Filter for WMI executions initiated by the `NETWORK SERVICE` account, as this often indicates remote execution via WMI.
- **Statistical Outliers**: Baseline "normal" WMI child processes in the environment and alert on rare or unique process executions (Stacking).
- **Event Logging**: Enable and monitor Windows Event Logs:
- **Microsoft-Windows-WMI-Activity/Operational** (Event ID 5857, 5858).
- **Security Log Event ID 4688** (Process Creation).
## Mitigation Strategies
- **Hardening**:
- Restrict remote WMI access through the Windows Firewall (block RPC/DCOM if not required).
- Use "Least Privilege" principles to limit which users can interact with WMI namespaces.
- **Prevention**:
- Disable the WMI service on sensitive hosts where it is not required for management.
- Monitor and restrict the use of administrative tools like `wmic.exe` and PowerShell's `Get-WmiObject` or `Invoke-CimMethod`.
## Related Tools/Techniques
- **WMIC.exe**: The command-line utility used to interact with WMI (now deprecated but still widely used by attackers).
- **Impacket (wmiexec.py)**: A popular Python framework used by attackers for remote WMI execution.
- **PowerSploit/Empire**: Post-exploitation frameworks containing WMI persistence modules.
- **DCOM (Distributed Component Object Model)**: The underlying protocol WMI uses for remote communication.