Full Report
MITRE ATT&CK Walkthrough: T1047 (Windows Management Instrumentation)
Analysis Summary
# Tool/Technique: T1047 - Windows Management Instrumentation (WMI)
## Overview
Windows Management Instrumentation (WMI) is a core Windows infrastructure component designed for data collection and administrative management. While essential for legitimate IT operations (patching, inventory, monitoring), it is heavily abused by attackers for remote execution, information gathering, lateral movement, and persistence because it is a trusted, built-in service that is rarely disabled.
## Technical Details
- **Type:** Technique (Living-off-the-Land)
- **Platform:** Windows
- **Capabilities:** Command execution, system discovery, lateral movement, and persistence.
- **First Seen:** Integrated into Windows since the NT 4.0 era; consistently used by modern threat actors.
## MITRE ATT&CK Mapping
- **TA0002 - Execution**
- T1047 - Windows Management Instrumentation
- **TA0008 - Lateral Movement**
- T1047 - Windows Management Instrumentation
- **TA0003 - Persistence**
- T1546.003 - Event Triggered Execution: WMI Event Subscription
## Functionality
### Core Capabilities
- **Command Execution:** Spawning processes on local or remote systems (e.g., `process call create`).
- **System Discovery:** Querying hardware specs, installed software, running processes, and network configurations.
- **Remote Management:** Utilizing DCOM (Port 135) or WinRM (Ports 5985/5986) to manage endpoints across a network.
### Advanced Features
- **Persistence:** Using WMI Event Subscriptions to execute malicious code automatically when specific system events occur (e.g., system uptime reaching a certain threshold), allowing threats to survive reboots.
- **Interface Evolution:** While the `wmic.exe` CLI is being retired in Windows 11 (August 2026), functionality remains accessible via PowerShell (`Invoke-WmiMethod`, `Get-CimInstance`) and direct COM API calls.
## Indicators of Compromise
- **File Names:** `wmic.exe` (legacy), `wmiprvse.exe` (WMI Provider Host).
- **Network Indicators:**
- Internal traffic over DCOM (TCP Port 135).
- Traffic over WinRM (TCP 5985 for HTTP; 5986 for HTTPS).
- Connections to unusual external IPs (defanged: `127[.]0[.]0[.]1`).
- **Behavioral Indicators:**
- `wmiprvse.exe` spawning unexpected child processes (e.g., `cmd.exe`, `powershell.exe`, or script hosts).
- WMI commands paired with `/node:` arguments targeting systems outside of standard management windows.
- A remote interactive logon followed immediately by WMI process creation.
## Associated Threat Actors
- **APT29** (Cozy Bear)
- **Scattered Spider**
## Detection Methods
- **Behavioral Detection:** Monitor for "Process Creation" events where `wmiprvse.exe` is the parent, especially when the child process involves encoded PowerShell commands or temporary binaries.
- **Correlation:** Link remote logon events (Event ID 4624) with subsequent WMI execution on the same destination host.
- **Persistence Monitoring:** Audit WMI repository changes, specifically `__EventFilter`, `__EventConsumer`, and `FilterToConsumerBinding` classes.
## Mitigation Strategies
- **Prevention Measures:** Restrict WMI access to authorized administrative accounts and jump boxes only.
- **Hardening recommendations:**
- Disable the WMI service if not required on specific high-risk endpoints.
- Use host-based firewalls to restrict RPC/DCOM and WinRM traffic to known management segments.
- Transition from legacy `wmic.exe` to restricted PowerShell usage with constrained language mode.
## Related Tools/Techniques
- **T1053.005:** Scheduled Tasks (often used in conjunction for persistence).
- **T1003.001:** OS Credential Dumping (LSASS memory dumping via WMI).
- **PowerShell:** Often the primary vehicle for executing WMI methods in modern environments.