Windows Management Instrumentation (WMI) Offense, Defense, and Forensics
As technology is introduced and subsequently deprecated over time in the Windows operating system, one powerful technology that has remained consistent since Windows NT 4.01 and Windows 952 is Windows Management Instrumentation (WMI). Present on all Windows operating systems, WMI is comprised of a powerful set of tools used to manage Windows systems both locally and remotely.
While it has been well known and utilized heavily by system administrators since its inception, WMI became popular in the security community when it was found to be used by Stuxnet3. Since then, WMI has been gaining popularity amongst attackers for its ability to perform system reconnaissance, anti-virus and virtual machine (VM) detection, code execution, lateral movement, persistence, and data theft. As attackers increasingly utilize WMI, it is important for defenders, incident responders, and forensic analysts to have knowledge of WMI and to know how they can wield it to their advantage.
Download this paper for an in-depth look at how the Windows Management Instrumentation (WMI) has been used by attackers and what network defenders can do to properly detect and respond to attacks that utilize WMI.