Wow, Microsoft is removing #WMIC from Windows!
But they aren't removing the underlying WMI framework, so threat actors will have to use PowerShell to access WMI.

I'm not sure this will have a significant impact on what Threat Actors do with WMI, however, it'll at least force a Threat Actor to use PowerShell where there is better built-in visibility (if it's enabled), compared to WMIC.

🔗 https://techcommunity.microsoft.com/blog/windows-itpro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/4039242

#IncidentResponse #ThreatDetection #ThreatIntel #CSIRT #CERT

⚠️ Top WMIC Commands Used by Malware and Greyware in the Past 7 Days (1/3 🧵)
#WMIC may be outdated, but it continues to provide #malware with stealth access to system information and configuration. Here are the top WMIC commands seen in #ANYRUN sandbox sessions over the past week.

1️⃣ SystemProfiling – 2391 uses
Example: https://app.any.run/tasks/b22ac552-8ca2-467e-a69a-4ccd7e1e5a05/?utm_source=mastodon&utm_medium=post&utm_campaign=wmic&utm_content=linktoservice&utm_term=290425
Command: wmic os get locale

#Cybersecurity #infosec

I just pocketed: Windows Command Line cheatsheet (part 2): WMIC

https://www.andreafortuna.org/2017/08/09/windows-command-line-cheatsheet-part-2-wmic/

#security #tutorial #windows #wmic