How to use wmi tools

While I thought I was being clever in my own WMI experiments, it turns out the pen tester community has been there and done that! You query this underlying Windows object to find users who are currently logged on. Got that? The next question is how to code the script block. The mythical insider in my scenario is interested in a specific user, Cruella.

You can gaze upon the complete solution below:. Keep in mind that our insider is laying low. You can make your lateral move when you get the notification from Register-WmiEvent. How does the script then return this interesting news that Cruella has logged on to the targeted machine?

Those of you who spotted the use of Netcat commands above get extra credit. Netcat is a well-known and versatile communications tool — not necessarily considered malware — that pops reverse shells , or can simply send a message across the network. I went with the latter option. Mission accomplished. In this scenario, I wanted to remotely launch using wmiexec a payload that would alert when a particular user, Cruella, logs into the system.

And then I could dump and crack her credentials. Anyway, this would be the stealthiest way to pull this off —both remote and fileless. The only problem, I thought at first, was the temporary nature of the WMI event. So I needed to encase my obscenely long Register-WMIEvent below into a PowerShell command line with the —noexit option, ensuring that the PowerShell stayed around after the Register-Event runs, and thereby preserving the event.

More headaches: I eventually had to abandon using pipes because it seemed to cause parsing errors. I eventually came up with this long, long one-liner :. It looked promising and it seemed to execute correctly based on looking at the Windows Event log on the target system.

WMI permanent events, though somewhat complicated, is a more effective way for insiders to conduct surveillance on their coworkers rather than using temporary events, and is a much better way to monitor for insider threats. Permanent events, though they take a little longer to learn how to use, are the most effective way of implementing a rigorous monitoring system for large systems.

They extend the capabilities that are available through WMI temporary events, and can also be used to alert you to more exotic forms of malicious behavior: for example, DNS tunneling or attempts to subvert your Zero Trust policies. I spent an afternoon or three looking into permanent events and discovered that PowerShell has a special cmdlet that streamlines the process of creating the event filter, consumer, and filter-consumer WMI objects.

As we all know, PowerShell gives admin awesome powers to make things easier. Unfortunately, this an example of where these powers can be used by the bad guys.

The insider creates a permanent event on the target system thereby relieving him of having to hang around in a shell session — the event stays forever or until its explicitly removed.

However, the latest version of administrative scripting and control is available through the Windows Management Infrastructure MI. MI is fully compatible with previous versions of WMI, and it provides a host of features and benefits that make designing and developing providers and clients easier than ever.

WMI can be used in all Windows-based applications, and is most useful in enterprise applications and administrative scripts. For more information, see Further information. To develop managed code providers or applications in C or Visual Basic. NET using the. NET Framework. You don't need to download or install a specific software development SDK in order to create scripts or applications for WMI.

However, there are some WMI administrative tools that developers find useful. If you need to run the command on remote computer:. In our WMI query guide we will explain how to get help from WMIC command, by drilling down each step of the command till we reach the desired result. This will give you all the switches and the aliases available. Now you want to know what the available verbs for that alias are:.

So now we want to know what properties of that alias are available:. After you run the query, you will see that the first line is the name of the Property and if you want to use it in a variable in a Batch file, then you will need to skip this line. We use this in a batch in order to filter it out:.

Sometimes the returned value contains a space character or two before the value and after the value, so you will need to filter those too. This site uses Akismet to reduce spam. Learn how your comment data is processed.

Why you need to query WMI repository For making a good automation you definitely use or used even once WMI repository in order to query for different types of information. Thus, if you know the structure of your table.

Name space: root Auth. Caption -eq 'iexplore. Caption -eq 'wmiprvse. Leave a Comment Cancel Reply Your email address will not be published. Type here.. Notice: We use tools, such as cookies, to enable essential services and functionality on our site and to collect data on how visitors interact with our site and services.