Abusing Windows Management Instrumentation (WMI)

by Matthew Graeber

Imagine a technology that is built into every Windows operating system going back to Windows 95, runs as System, executes arbitrary code, persists across reboots, and does not drop a single file to disk. Such a thing does exist and it's called Windows Management Instrumentation (WMI).

With increased scrutiny from anti-virus and 'next-gen' host endpoints, advanced red teams and attackers already know that the introduction of binaries into a high-security environment is subject to increased scrutiny. WMI enables an attacker practicing a minimalist methodology to blend into their target environment without dropping a single utility to disk. WMI is also unlike other persistence techniques in that rather than executing a payload at a predetermined time, WMI conditionally executes code asynchronously in response to operating system events.

This talk will introduce WMI and demonstrate its offensive uses. We will cover what WMI is, how attackers are currently using it in the wild, how to build a full-featured backdoor, and how to detect and prevent these attacks from occurring.

[erdem--]

it is just breathtaking. wonder why this is so underrated

[MrHardy-tlow]

Great video. Over the past couple months I have been using Empire's invoke_wmi module as a Red Team attack path against my capstone team's environment.

[BloomfieldBlanche]

Smith Charles Wilson Christopher Williams Melissa

[kevinreed]

Those “mmmkay” and “oh rite” every 30 seconds are really annoying.