Reply to thread

Message

<blockquote data-quote="Eddie Morra" data-source="post: 760493">Windows Management Instrumentation (WMI) is liked by attackers because it can be used in file-less attacks, is simple to work and automate tasks with, and it is usually always enabled on a traditional Windows environment. You can use WMI straight from VBScript and PowerShell which is always a bonus for attackers because they tend to like using those as well.I recommend you seek the official WMI documentation by Microsoft to learn more about what can be done with WMI. There&#039;s a lot that can be done with it.Some vendors have written articles/papers on WMI from a threat-research perspective:<a href="https://blog.trendmicro.com/trendlabs-security-intelligence/windows-wmi-abused-for-malware-operations/" target="_blank">WMI Abused for Malware Operations - TrendLabs Security Intelligence Blog</a><a href="https://blog.malwarebytes.com/cybercrime/2016/10/explained-wmi-hijackers/" target="_blank">Explained: WMI hijackers - Malwarebytes Labs</a><a href="http://la.trendmicro.com/media/misc/understanding-wmi-malware-research-paper-en.pdf" target="_blank">http://la.trendmicro.com/media/misc/understanding-wmi-malware-research-paper-en.pdf</a></blockquote>

[QUOTE="Eddie Morra, post: 760493"] Windows Management Instrumentation (WMI) is liked by attackers because it can be used in file-less attacks, is simple to work and automate tasks with, and it is usually always enabled on a traditional Windows environment. You can use WMI straight from VBScript and PowerShell which is always a bonus for attackers because they tend to like using those as well. I recommend you seek the official WMI documentation by Microsoft to learn more about what can be done with WMI. There's a lot that can be done with it. [B]Some vendors have written articles/papers on WMI from a threat-research perspective:[/B] [URL='https://blog.trendmicro.com/trendlabs-security-intelligence/windows-wmi-abused-for-malware-operations/']WMI Abused for Malware Operations - TrendLabs Security Intelligence Blog[/URL] [URL='https://blog.malwarebytes.com/cybercrime/2016/10/explained-wmi-hijackers/']Explained: WMI hijackers - Malwarebytes Labs[/URL] [URL]http://la.trendmicro.com/media/misc/understanding-wmi-malware-research-paper-en.pdf[/URL] [/QUOTE]

Verification