Windows Management Instrumentation
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) suc...
BY SOURCE
PROCEDURES (46)
Auto-extracted: 14 detections for wmi
Auto-extracted: 4 detections for service
Auto-extracted: 3 detections for child process
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for script execution monitoring
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for process creation monitoring
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for shadow cop
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for dll hijack
Auto-extracted: 2 detections for office
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for dll hijack
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for dll hijack
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for dll hijack
Auto-extracted: 1 detections for office
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for registry
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for wmi