T1047 Windows Management Instrumentation

Technique

T1047

Tactics

Execution

Research, 90 days

3

KEV CVEs mapped

2

SigmaHQ rules

52

Elastic, Splunk

42

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1047

MITRE description

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by [Remote Services](https://attack.mitre.org/techniques/T1021) such as [Distributed Component Object Model](https://attack.mitre.org/techniques/T1021/003) and [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3)(Citation: Mandiant WMI) An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for [Discovery](https://attack.mitre.org/tactics/TA0007) as well as [Execution](https://attack.mitre.org/tactics/TA0002) of commands and payloads.(Citation: Mandiant WMI) For example, `wmic.exe` can be abused by an adversary to delete shadow copies with the command `wmic.exe Shadowcopy Delete` (i.e., [Inhibit System Recovery](https://attack.mitre.org/techniques/T1490)).(Citation: WMI 6) **Note:** `wmic.exe` is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by [PowerShell](https://attack.mitre.org/techniques/T1059/001) as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like `wbemtool.exe`, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

• CVE-2021-44077
• CVE-2021-40539

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-29 Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-08 ESET: MATCHBOIL: New tricks, same old evil intentions

Detection coverage

SigmaHQ community rules

• Blue Mockingbird (emerging-threats)
• Blue Mockingbird - Registry (emerging-threats)
• Potential Maze Ransomware Activity (emerging-threats)
• UNC2452 PowerShell Pattern (emerging-threats)
• WMI Module Loaded By Uncommon Process (threat-hunting)
• Remote DCOM/WMI Lateral Movement (core)
• MITRE BZAR Indicators for Execution (core)
• Successful Account Login Via WMI (core)
• T1047 Wmiprvse Wbemcomn DLL Hijack (core)
• PSExec and WMI Process Creations Block (core)
• Wmiexec Default Output File (core)
• Wmiprvse Wbemcomn DLL Hijack - File (core)
• Wmiprvse Wbemcomn DLL Hijack (core)
• WMI Event Consumer Created Named Pipe (core)
• WMIC Unquoted Services Path Lookup - PowerShell (core)
• WMImplant Hack Tool (core)
• Suspicious Autorun Registry Modified via WMI (core)
• HTML Help HH.EXE Suspicious Child Process (core)
• Suspicious HH.EXE Execution (core)
• HackTool - CrackMapExec Execution Patterns (core)
• HackTool - CrackMapExec Execution (core)
• HackTool - Potential Impacket Lateral Movement Activity (core)
• Suspicious Microsoft Office Child Process (core)
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class (core)
• Script Event Consumer Spawning Process (core)

Showing 25 of 52 community rules. the full set is tagged attack.t1047 in SigmaHQ.

Elastic and Splunk rules

• Suspicious ScreenConnect Client Child Process (elastic)
• Suspicious .NET Code Compilation (elastic)
• Microsoft Build Engine Started by a System Process (elastic)
• Suspicious Execution from a Mounted Device (elastic)
• Suspicious Managed Code Hosting Process (elastic)
• Suspicious WMIC XSL Script Execution (elastic)
• Delayed Execution via Ping (elastic)
• Enumeration Command Spawned via WMIPrvSE (elastic)
• Mofcomp Activity (elastic)
• Suspicious Cmd Execution via WMI (elastic)
• Suspicious WMI Image Load from MS Office (elastic)
• Volume Shadow Copy Deletion via PowerShell (elastic)
• Volume Shadow Copy Deletion via WMIC (elastic)
• Windows Script Interpreter Executing Process via WMI (elastic)
• WMI Incoming Lateral Movement (elastic)
• Persistence via WMI Event Subscription (elastic)
• Persistence via WMI Standard Registry Provider (elastic)
• Web Shell Detection: Script Process Child of Common Web Processes (elastic)
• Service Control Spawned via Script Interpreter (elastic)
• Security Software Discovery using WMIC (elastic)
• Windows System Information Discovery (elastic)
• WMI WBEMTEST Utility Execution (elastic)
• Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM (elastic)
• WMIC Remote Command (elastic)
• Impacket Lateral Movement Commandline Parameters (splunk)

Showing 25 of 42.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.