WMI Sessions in PowerShell (CIM Cmdlets)

Windows Management Instrumentation (WMI) is Microsoft’s CIM-based management plane — the substrate for remote querying and command execution across a Windows estate (MITRE T1047). The modern PowerShell interface is the CIM cmdlets (New-CimSession, Get-CimInstance, Invoke-CimMethod), which supersede the legacy *-Wmi* cmdlets and the deprecated wmic.exe CLI.

Connectivity requirements

• Ports (DCOM protocol): TCP 135 (RPC endpoint mapper) + dynamic high ports TCP 49152–65535
• Ports (WSMan protocol): TCP 5985 (WinRM/HTTP) or TCP 5986 (WinRM/HTTPS) — the same transport as windows-remote-management
• Group membership: local Administrators on the target (DCOM hardening and WMI namespace ACLs can loosen this, but admin is the practical default)

DCOM is the default protocol for New-CimSession against down-level compatibility targets; WSMan is the default on modern PowerShell and is the only option from PowerShell Core on Linux/macOS.

Establishing a session

# Build a PSCredential object
$SECURE_PASSWORD = ConvertTo-SecureString "$TARGET_PASSWORD" `
                                          -AsPlainText -Force
$CREDENTIAL_OBJECT = `
        New-Object System.Management.Automation.PSCredential `
                   $TARGET_USER, $SECURE_PASSWORD
 
# Protocol: DCOM (RPC over TCP 135, like sc.exe/schtasks.exe)
# or WSMAN (WinRM over 5985/5986). -ErrorAction Stop makes
# failures catchable instead of quietly returning $null.
$OPTIONS_OBJECT = New-CimSessionOption -Protocol DCOM
$SESSION_OBJECT = New-CimSession `
                      -ComputerName $TARGET_HOST `
                      -Credential $CREDENTIAL_OBJECT `
                      -SessionOption $OPTIONS_OBJECT `
                      -ErrorAction Stop

Once $SESSION_OBJECT exists it can be reused across Get-CimInstance / Invoke-CimMethod calls — most importantly Invoke-CimMethod -ClassName Win32_Service -MethodName Create, the service-creation primitive documented in wmi-remote-service-execution.

Offense and defense notes

• Offense: CIM sessions are the plumbing behind wmiexec-style tooling, but ride native PowerShell — no binaries dropped. DCOM sessions blend with ordinary admin RPC; WSMan sessions blend with ordinary WinRM. Both inherit the caller’s token after authentication, per dcerpc semantics.
• Defense: WMI activity surfaces as WmiPrvSE.exe child processes on the target (Sysmon EID 1), plus DCOM/WinRM network flows. CIM cmdlets also emit PowerShell script-block logs (EID 4104) on the caller side, unlike legacy wmic — one reason Microsoft pushes operators toward PowerShell.
• Session objects persist until closed: Remove-CimSession $SESSION_OBJECT when done.

Sources

• MITRE ATT&CK T1047 — Windows Management Instrumentation
• Microsoft Learn — New-CimSession
• Microsoft Learn — New-CimSessionOption

Related: wmi-remote-service-execution, invoke-cimmethod-remote-command, wmic, windows-remote-management, dcerpc, exploit-windows-scheduled-tasks, wmi-remote-scheduled-task