Mofcomp.exe — LOLBAS

Execute

Execution Windows

Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository

Use Threat actors can use mofcomp.exe to register a malicious MOF file as a new class in the WMI repository

mofcomp.exe {PATH_ABSOLUTE:.mof}

Context: user
Native: Execute
MITRE: T1047
Detection: IOC: strange parent processes spawning mofcomp.exe like cmd.exe or powershell.exe
Sigma: github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
Refs: docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-
thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96
lolbas-project.github.io/lolbas/Binaries/Mofcomp/