T1047.md

T1047 - Windows Management Instrumentation

Description from ATT&CK

Windows Management Instrumentation (WMI) is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) (Citation: Wikipedia SMB) and Remote Procedure Call Service (RPCS) (Citation: TechNet RPC) for remote access. RPCS operates over port 135. (Citation: MSDN WMI)

An adversary can use WMI to interact with local and remote systems and use it as a means to perform many tactic functions, such as gathering information for Discovery and remote Execution of files as part of Lateral Movement. (Citation: FireEye WMI 2015)

Atomic Tests

• Atomic Test #1 - WMI Reconnaissance Users

• Atomic Test #2 - WMI Reconnaissance Processes

• Atomic Test #3 - WMI Reconnaissance Software

• Atomic Test #4 - WMI Reconnaissance List Remote Services

• Atomic Test #5 - WMI Execute Local Process

• Atomic Test #6 - WMI Execute Remote Process

Atomic Test #1 - WMI Reconnaissance Users

WMI List User Accounts

Supported Platforms: Windows

Attack Commands: Run with command_prompt!

wmic useraccount get /ALL

Atomic Test #2 - WMI Reconnaissance Processes

WMI List Processes

Supported Platforms: Windows

Attack Commands: Run with command_prompt!

wmic process get caption,executablepath,commandline

Atomic Test #3 - WMI Reconnaissance Software

WMI List Software

Supported Platforms: Windows

Attack Commands: Run with command_prompt!

wmic qfe get description,installedOn /format:csv

Atomic Test #4 - WMI Reconnaissance List Remote Services

WMI List Remote Services

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
node	Ip Address	String	192.168.0.1
service_search_string	Name Of Service	String	sql server

Attack Commands: Run with command_prompt!

wmic /node:"#{node}" service where (caption like "%#{service_search_string} (%")

Atomic Test #5 - WMI Execute Local Process

This test uses wmic.exe to execute a process on the local host.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
process_to_execute	Name or path of process to execute.	String	calc.exe

Attack Commands: Run with command_prompt!

wmic process call create #{process_to_execute}

Atomic Test #6 - WMI Execute Remote Process

This test uses wmic.exe to execute a process on a remote host.

Supported Platforms: Windows

Inputs:

Name	Description	Type	Default Value
node	Ip Address	String	192.168.0.1
process_to_execute	Name or path of process to execute.	String	calc.exe

Attack Commands: Run with command_prompt!

wmic /node:"#{node}" process call create #{process_to_execute}