An Overview of WMI Hijacking Techniques in Modern Malware

guest · Nov 2, 2020

An Overview of WMI Hijacking Techniques in Modern Malware
October 28, 2020
https://labs.bitdefender.com/2020/10/an-overview-of-wmi-hijacking-techniques-in-modern-malware/

The discovery of Stuxnet in 2010, followed by its in-depth analysis, uncovered several “industry firsts”, including hijacking of Windows Management Instrumentation (WMI) to enumerate users and spread to available network shares.

In the past decade, most of the malware features at least one technique to hijack WMI for persistence, discovery, lateral movement or defense evasion.
Click to expand...

This whitepaper describes how WMI hijacking works and how it is used in several families of malware currently in existence.
Sounds interesting? Download the paper below:
Click to expand...

Whitepaper: "A Decade of WMI Abuse – an Overview of Techniques in Modern Malware"
(PDF): https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf

This article details a collection of malware that use WMI to achieve their goal. This compilation aims to inform security practitioners and decision- makers about current malicious techniques, each in correspondence with the tactics from the MITRE Att&ck Matrix[2], and remind our partners of the importance of proper WMI monitoring in combating cyber attacks.
Click to expand...

Conclusion
The Windows Management Instrumentation offers a plethora of benefits to administrators, but also offers many advantages to malicious actors. Given that WMI allows the orchestration of fileless attacks, we see increased focus on these techniques in the wild. In terms of both legitimate and malicious use, WMI offers the flexibility to obtain information about systems, to configure settings even for remote computers and applications, to schedule processes to run at specific times, to enable and disable logging and to obtain code execution.

While WMI abuse has been going on for nearly a decade, it continues to evolve. Today it can take place in multiple creative scenarios, affecting a significant number of techniques. From Stuxnet onwards, modern malware incorporates evasion techniques based on WMI, and unfortunately these small pieces can make the difference between a stopped attack and total compromise.
Click to expand...

Rasheed187 · Nov 8, 2020

Thanks, interesting stuff and I have always hated this stupid "Windows Management Instrumentation" stuff. I also sometimes see it using CPU time on my system for no apparent reason.

https://www.neuber.com/taskmanager/process/wmiprvse.exe.html

xxJackxx · Nov 10, 2020

WMI is a piece of junk they came up with a long time ago and never fixed. Check the event logs on any PC and you will see countless WMI issues.

Log in or Sign up

An Overview of WMI Hijacking Techniques in Modern Malware

guest Guest

Rasheed187 Registered Member

xxJackxx Registered Member

Log in or Sign up

An Overview of WMI Hijacking Techniques in Modern Malware

guest Guest

Rasheed187 Registered Member

xxJackxx Registered Member

Useful Searches