Windows Management Instrumentation (WMI) Offense, Defense, and Forensic

A fresh white paper was released by FireEye. It’s “Windows Management Instrumentation (WMI) Offense, Defense, and Forensic” by William Ballenthin, Matt Graeber and Claudiu Teodorescu.

Here is the introduction:

As technology is introduced and subsequently deprecated over time in the Windows operating system, one powerful technology that has remained consistent since Windows NT 4.01 and Windows 952 is Windows Management Instrumentation (WMI). Present on all Windows operating systems, WMI is comprised of a powerful set of tools used to manage Windows systems both locally and remotely.

While it has been well known and utilized heavily by system administrators since its inception, WMI became popular in the security community when it was found to be used by Stuxnet3. Since then, WMI has been gaining popularity amongst attackers for its ability to perform system reconnaissance, anti-virus and virtual machine (VM) detection, code execution, lateral movement, persistence, and data theft.

As attackers increasingly utilize WMI, it is important for defenders, incident responders, and forensic analysts to have knowledge of WMI and to know how they can wield it to their advantage. This whitepaper introduces you to WMI, demonstrates actual and proof-of-concept attacks using WMI, shows how WMI can be used as a rudimentary intrusion detection system (IDS), and presents how to perform forensics on the WMI repository file format.