WMIC.exe
Sources: 300M+ executions observed in the wild.
Summary
WMIC (Windows Management Instrumentation Command-line) is a command-line interface to WMI, providing access to system information, process management, and remote administration capabilities. Microsoft has deprecated WMIC as of Windows 11, recommending PowerShell as the replacement for WMI queries.
WMIC.exe is the 37th most commonly executed Windows program in EchoTrail's dataset, observed 1,045,753 times across enterprise environments. It typically runs from C:\Windows\System32\wbem and it is most often launched by cmd.exe.
Get this in your tools
The same record for wmic.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/wmic.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32\wbem98.55%
- C:\Windows\SysWOW64\wbem1.45%
Top Hashes (SHA256)
- a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e43.32%
- 69fe210903c3f03436fe9f00a493cdb822a64ea17a5729593bbe9ec3e0763c1b21.94%
- fa78c88dac91fdf2eac736e6900ac1ec4ab7a388b8f77a23ffa7e80a4ad29f5a14.52%
- 74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf7617312.82%
- 6679ea8fbeb539b5852ce8838420471fed0600f5050f3370dbb355dac76bf0721.78%
- d368bcb7934db0c53d1e7277dcb47af2b709253cbf0eee9869ee7e17ed226ea31.72%
- da3ad32583644bd20116f0479c178f7c7c0b730728f4c02a438c0d19378c83d91.39%
- 12abb45620a7a1ffd8bb953deba3fcc30b8ba14b2ff523f1f519bf2bf6ba7d4c1.29%
- 3257cab2b2c03b9fc11f1b478ac25279df72a00f515166ed3999a517139cdd990.49%
- 0cde337426e339fdf0518400c6302e5068768ffacc9cfac81be820f8dcfbf9440.07%
Process Ancestry
Top Grandparents
- LTSVC.exe82.54%
- services.exe17.3%
- jumpcloud-agent.exe0.05%
- explorer.exe0.03%
- 32bitProxy.exe0.02%
- Asusgiftbox.exe0.01%
- cncmd.exe0.01%
- runkbot.exe0.01%
- cmd.exe<0.01%
- CCXProcess.exe<0.01%
Top Parents
- cmd.exe80.27%
- powershell.exe7.88%
- svchost.exe1.56%
- LogiBolt.exe0.03%
- Code.exe0.02%
- GoogleDriveFS.exe0.01%
- RadeonSettings.exe0.01%
- FortiClient.exe0.01%
Top Children
- conhost.exe100%
Security Analysis
What does WMIC.exe normally do?
Located in C:\Windows\System32\wbem or C:\Windows\SysWOW64\wbem. Commonly launched by cmd.exe, powershell.exe, or management agents (Amazon SSM Agent). Typically spawns conhost.exe. Used for querying system information, managing processes and services, and remote administration.
When is WMIC.exe suspicious?
Running from any path outside the wbem directories. Process creation commands (wmic process call create). Remote execution targeting other hosts (/node: parameter). XSL script processing (wmic os get /format:). Spawned by unusual parents like Office applications, w3wp.exe, or mshta.exe. Rapid sequential execution suggesting enumeration scripts.
How do attackers abuse WMIC.exe?
System reconnaissance: attackers query OS version, installed software, running processes, network configuration, and user accounts via wmic. Remote process execution: wmic /node:<target> process call create allows execution on remote systems, generating wmiprvse.exe activity on the target. XSL script processing: wmic can load and execute XSL stylesheets containing JScript or VBScript, bypassing application whitelisting. Lateral movement: combined with stolen credentials, wmic enables remote command execution without deploying additional tools.
Detection guidance
High-confidence: wmic with /node: parameter (remote execution). wmic with process call create (process creation). wmic with /format: pointing to remote or unusual XSL files. Medium-confidence: wmic spawned by Office applications, mshta.exe, or script interpreters. Correlate with wmiprvse.exe activity on remote hosts when /node: is detected. Monitor for Sysmon Event ID 1 with command-line arguments.
False positive notes
Management agents (Amazon SSM Agent, SCCM) frequently use wmic for inventory and health checks. System administrators use wmic for legitimate remote management. Some monitoring tools query wmic for system information at regular intervals.
Related Processes
Ask Rocky about WMIC.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for WMIC.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.