Identifier / Programs / Windows
mofcomp.exe
The Managed Object Format (MOF) Compiler file version info (xCyclopedia)
LOLBAS Execute 1 Sigma rule name it 2 ATT&CK techniques 1 documented command 16 known copies with hashes
How mofcomp.exe is abused
Execute T1047 Windows Management Instrumentation
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for mofcomp.exe.
1 documented command
Execute T1047 Windows Management Instrumentation User privileges
Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository
mofcomp.exe {PATH_ABSOLUTE:.mof}The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for mofcomp.exe, by Daniel Gott, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for mofcomp.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real mofcomp.exe?
C:\Windows\system32\wbem\C:\Windows\SysWOW64\wbem\16 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
291e9fb6f7ea45037c2e12172dea641ef1f744621621a498e1b25cda0701165210.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\mofcomp.exe · signed by Microsoft Windows
596a1e4440adfea007bc954776cede0c8c46bf8ec87d910e5a882b1c0b771e6e10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
130dc78122599e4593a464be53bd2a9f6a6f2cc3d7d92a43b94cfded6918438110.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
555b1f567a3ad1d26e6a286d4f0e16a0e30a305ba8d83a225b889047134ddef510.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\mofcomp.exe · signed by Microsoft Windows
6e589d7d741587143526c36a5cad5791031d3c52d9e7e0dbfc39cd5c207f7b2f10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\mofcomp.exe · signed by Microsoft Windows
c6997c7079f983fac9a928fa87ca9824cf7bef3979735ac5c1f690ebdceba77010.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\mofcomp.exe · signed by Microsoft Windows
f70f849225f5dafe5890ad8308cb6b136385fa84dbe148805fb9a63dc91f70f410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
ff02023bd6ac4e65644ffc1d300d45544b047cab7a96e33f63edaa16a24e067d10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
6652f359177150b7a8cb95ad119a32e53a7c61c112b9db64761bf25989df449a10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\mofcomp.exe · signed by Microsoft Windows
f74eec05ed51feb73ff444f0cc592216f7baf77cd5414019b755926b54900da310.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
6b74bb2bfe0cda5617eac3a3eefccc9554186b098dc70da573b153af3652556910.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\mofcomp.exe · signed by Microsoft Windows
ec049a032436a2bd31491aee3bf054aae9d63b24282186f208d93a4cf4c946c910.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wbem\mofcomp.exe · signed by Microsoft Windows
80fd3cf169a71efc71bf3661641278e5ba9b23a93097957a60244111b3a6ad4410.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wbem\mofcomp.exe · signed by Microsoft Windows
a4a0028253149e7dc59a8deb72e91b46a6c03cac798d8d0d84fc6e36c9a5925d6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wbem\mofcomp.exe · not signed
2648bf5f04685dc297ebafcf237ba24259d219f726ba7050b5d4739867ccd11f6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wbem\mofcomp.exe · not signed
69389ab614d366b30d46e09b186a3831d74db81e81ed76cb85f4f9f14e14ac46From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.