Cybercriminals Exploit Windows Management Instrumentation WMI to Maintain Stealthy Access and Silent Control

[Brownie2019]

Content source

https://gbhackers.com/cybercriminals-exploit-windows-management-instrumentation-wmi/

Windows Management Instrumentation (WMI) is a critical utility built into the Windows operating system designed to help administrators monitor status and automate routine tasks.
However, cybercriminals have increasingly weaponized this legitimate infrastructure to maintain persistent access to compromised networks.
Unlike traditional malware strategies that rely on visible startup folders or registry run keys, WMI abuse allows attackers to hide in plain sight.
By leveraging WMI Event Subscriptions, hackers can ensure their malicious payloads execute automatically without leaving obvious traces that standard antivirus scans typically flag.

Read morer here:

Cybercriminals Exploit Windows Management Instrumentation WMI to Maintain Stealthy Access and Silent Control

Windows Management Instrumentation (WMI) is a critical utility built into the Windows operating system designed to help administrators monitor status.

gbhackers.com

 

[Parkinsond]

Can such ASR rules (Block process creations originating from PSExec and WMI commands and Block persistence through WMI event subscription) mitigate?

 

[Halp2001]

WMI abuse hides inside legitimate processes, so it’s wise to strengthen defenses:

• Audit event subscriptions and apply ASR rules.
• Monitor anomalous processes with EDR.
• Restrict administrative privileges.
• Regularly review security logs.

Combining these actions greatly reduces the risk of attackers staying invisible

 

[Andy Ful]

Can such ASR rules (Block process creations originating from PSExec and WMI commands and Block persistence through WMI event subscription) mitigate?

Yes. This rule was created for that. However, I did not see any comprehensive test on how effective it is in practice.

 

[Parkinsond]

Yes. This rule was created for that. However, I did not see any comprehensive test on how effective it is in practice.

I was asking as I could not find any use for such rules in all the scenarios mentioned in CD and WHHL threads; I think this type of attacks is rare.

 

[Andy Ful]

I was asking as I could not find any use for such rules in all the scenarios mentioned in CD and WHHL threads; I think this type of attacks is rare.

WMI is often used in the discovery phase and sometimes for persistence.