WMIC.exe

by Microsoft
Operating SystemLOLBinhigh risk

Sources: 300M+ executions observed in the wild.

Summary

WMIC (Windows Management Instrumentation Command-line) is a command-line interface to WMI, providing access to system information, process management, and remote administration capabilities. Microsoft has deprecated WMIC as of Windows 11, recommending PowerShell as the replacement for WMI queries.

WMIC.exe is the 37th most commonly executed Windows program in EchoTrail's dataset, observed 1,045,753 times across enterprise environments. It typically runs from C:\Windows\System32\wbem and it is most often launched by cmd.exe.

Get this in your tools

The same record for wmic.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/wmic.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

37th
most commonly executed Windows program
1,045,753
observed endpoint executions

Behavior

Top Paths

  • C:\Windows\System32\wbem98.55%
  • C:\Windows\SysWOW64\wbem1.45%

Top Hashes (SHA256)

  • a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e43.32%
  • 69fe210903c3f03436fe9f00a493cdb822a64ea17a5729593bbe9ec3e0763c1b21.94%
  • fa78c88dac91fdf2eac736e6900ac1ec4ab7a388b8f77a23ffa7e80a4ad29f5a14.52%
  • 74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf7617312.82%
  • 6679ea8fbeb539b5852ce8838420471fed0600f5050f3370dbb355dac76bf0721.78%
  • d368bcb7934db0c53d1e7277dcb47af2b709253cbf0eee9869ee7e17ed226ea31.72%
  • da3ad32583644bd20116f0479c178f7c7c0b730728f4c02a438c0d19378c83d91.39%
  • 12abb45620a7a1ffd8bb953deba3fcc30b8ba14b2ff523f1f519bf2bf6ba7d4c1.29%
  • 3257cab2b2c03b9fc11f1b478ac25279df72a00f515166ed3999a517139cdd990.49%
  • 0cde337426e339fdf0518400c6302e5068768ffacc9cfac81be820f8dcfbf9440.07%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Security Analysis

What does WMIC.exe normally do?

Located in C:\Windows\System32\wbem or C:\Windows\SysWOW64\wbem. Commonly launched by cmd.exe, powershell.exe, or management agents (Amazon SSM Agent). Typically spawns conhost.exe. Used for querying system information, managing processes and services, and remote administration.

When is WMIC.exe suspicious?

Running from any path outside the wbem directories. Process creation commands (wmic process call create). Remote execution targeting other hosts (/node: parameter). XSL script processing (wmic os get /format:). Spawned by unusual parents like Office applications, w3wp.exe, or mshta.exe. Rapid sequential execution suggesting enumeration scripts.

How do attackers abuse WMIC.exe?

System reconnaissance: attackers query OS version, installed software, running processes, network configuration, and user accounts via wmic. Remote process execution: wmic /node:<target> process call create allows execution on remote systems, generating wmiprvse.exe activity on the target. XSL script processing: wmic can load and execute XSL stylesheets containing JScript or VBScript, bypassing application whitelisting. Lateral movement: combined with stolen credentials, wmic enables remote command execution without deploying additional tools.

Detection guidance

High-confidence: wmic with /node: parameter (remote execution). wmic with process call create (process creation). wmic with /format: pointing to remote or unusual XSL files. Medium-confidence: wmic spawned by Office applications, mshta.exe, or script interpreters. Correlate with wmiprvse.exe activity on remote hosts when /node: is detected. Monitor for Sysmon Event ID 1 with command-line arguments.

False positive notes

Management agents (Amazon SSM Agent, SCCM) frequently use wmic for inventory and health checks. System administrators use wmic for legitimate remote management. Some monitoring tools query wmic for system information at regular intervals.

MITRE ATT&CK techniques

Related Processes

Ask Rocky about WMIC.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for WMIC.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.