The ABCs of WMI - Finding Evil in Plain Sight

To date, WMI is one of the few forensic topics that hasn't been widely covered on this channel. Let's fix that and explore how we can separate legitimate WMI usage from attacker activity. We'll start with a review and cover the basics of this technology. Then we'll spend the rest of the episode looking at how we can enumerate the contents of the WMI database on a live system and on a dead system.

📖 Chapters

00:00 - Intro
04:37 - Analyzing WMI with Autoruns for Windows
06:41 - Analyzing WMI with PowerShell
09:48 - Using KAPE to Acquire WMI Artifacts
14:16 - Recap

🛠 Resources

Autoruns for Windows:

KAPE:

MITRE ATT&CK - Windows Management Instrumentation:

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics

[ianthecat]

Great content! still applicable even up to this date.
I hope you could continue working on more dfir videos specially with the new OS releases and updates.
Thank you very much for this!

[NaveenKumarDevaraja]

Thanks, very useful content for DFIR Practitioners at this moment. Almost every Security Incident and Threat actor has been leveraging WMI and PsExec capabilities!

[TheKiller]

Another great video, as always. Are there any other good resources for learning WMI forensics? Also, do you like Microsoft flight simulator?

[john]

Thanks for all your videos, I’m really liking them a lot ! :D
Have you planned to do some video on the methodology for finding evidence of intrusion ?
It could start with one of those : a. Email containing a malicious file, b. Accessing a malicious URL in the browser, c. After a web server is compromised and a webshell deployed.
It would be great to see how you start an investigation in those cases. What kind of artifacts do you analyze first ? What assumptions do you take to build from there ? Etc. :-)

[GraemeMeyer-gq]

@13Cubed the transcript for this video seems to be in Korean or something - might be worth regenerating it?

[paulosilva-dmqb]

Nice presentation. One question. Can´t we just check with Wbemtest?