Technique:  Windows Management Instrumentation
During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.
Action RAT can use WMI to gather AV products installed on an infected host.
Agent Tesla has used wmi queries to gather information from the system.
It used WMI to steal credentials and execute backdoors at a future time.
It used WMI to deploy their tools on remote machines and to gather information about the Outlook process.
It used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.
Astaroth uses WMIC to execute payloads.
Avaddon uses wmic.exe to delete shadow copies.
BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.
Bazar can execute a WMI query to gather information about the installed antivirus engine.
Black Basta has used WMI to execute files over the network.
BlackCat can use wmic.exe to delete shadow copies on compromised networks.
A BlackEnergy 2 plug-in uses WMI to gather victim host details.
It has used wmic.exe to set environment variables.
Brute Ratel C4 can use WMI to move laterally.
Bumblebee can use WMI to gather system information and to spawn processes for code injection.
During C0015, the threat actors used wmic and rundll32 to load Cobalt Strike onto a target host.
During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host (wmiprvse.exe) to execute a variety of encoded PowerShell scripts using the DownloadString method.
During C0027, It used Windows Management Instrumentation (WMI) to move laterally via Impacket.
CharmPower can use wmic to gather information from a system.
It has used WMIC to execute remote commands.
Cobalt Strike can use WMI to deliver a payload to a remote host.
CrackMapExec can execute remote commands using Windows Management Instrumentation.
DarkTortilla can use WMI queries to obtain system information.
DarkWatchman can use WMI to execute commands.
DEATHRANSOM has the ability to use WMI to delete volume shadow copies.
The It group is known to utilize WMI for lateral movement.
The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.
It used a VBA script to execute WMI.
EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.
Emotet has used WMI to execute powershell.exe.
Empire can use WMI to deliver a payload to a remote host.
EvilBunny has used WMI to gather information about the system.
EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.
FELIXROOT uses WMI to query the Windows Registry.
It has utilized WMI to execute commands and move laterally on compromised Windows machines.
It has used WMI to automate the remote execution of PowerShell scripts.
It has used WMI to install malware on targeted systems.
It's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. It has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.
FIVEHANDS can use WMI to delete files on a  target machine.
FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.
During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.
FunnyDream can use WMI to open a Windows command shell on a remote machine.
During FunnyDream, the threat actors used wmiexec.vbs to run remote commands.
It used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.
It has used WMI to execute scripts used for discovery.
GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).
HALFBAKED can use WMI queries to gather system information.
HELLOKITTY can use WMI to delete volume shadow copies.
HermeticWizard can use WMI to create a new process on a remote machine via C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll.
HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.
IcedID has used WMI to execute binaries.
Impacket's wmiexec module can be used to execute commands through WMI.
It has used WMIC to execute commands on remote computers.
jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.
Kazuar obtains a list of running processes through WMI querying.
Koadic can use WMI to execute commands.
KOMPROGO is capable of running WMI queries.
It has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.
It has used WMI for execution.
Lucifer can use WMI to log into remote machines for propagation.
It has used a tool to run cmd /c wmic computersystem get domain for discovery.
Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.
It has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.
Meteor can use wmic.exe as part of its effort to delete shadow copies.
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.
MoleNet can perform WMI commands on the system.
Mosquito's installer uses WMI to search for antivirus display names.
It has used malware that leveraged WMI for execution and querying host information.
It has executed PowerShell scripts via WMI.
It has used WMIC.exe for lateral movement.
Netwalker can use WMI to delete Shadow Volumes.
NotPetya can use wmic to help propagate itself across a network.
Octopus has used wmic.exe for local discovery information.
It has used WMI for execution.
Olympic Destroyer uses WMI to help propagate itself across a network.
OopsIE uses WMI to perform discovery techniques.
During Operation Dream Job, It used WMIC to executed a remote XSL script.
During Operation Wocao, threat actors has used WMI to execute commands.
PoshC2 has a number of modules that use WMI to execute tasks.
PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.
POWERSTATS can use WMI queries to retrieve data from compromised hosts.
POWRUNER may use WMI when collecting information about a victim.
ProLock can use WMIC to execute scripts on targeted hosts.
PyDCrypt has attempted to execute with WMIC.
QakBot can execute WMI queries to gather information.
RATANKBA uses WMI to perform process monitoring.
Remexi executes received commands with wmic.exe (for WMI commands).
REvil can use WMI to monitor for and kill specific processes listed in its configuration file.
RogueRobin uses various WMI queries to check if the sample is running in a sandbox.
It has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.
Sardonic can use WMI to execute PowerShell commands on a compromised machine.
SharpStage can use WMI for execution.
Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.
SILENTTRINITY can use WMI for lateral movement.
Snip3 can query the WMI class Win32_ComputerSystem to gather information.
During the SolarWinds Compromise, It used WMI for the remote execution of files for lateral movement.
It malware gathers system information via Windows Management Instrumentation (WMI).
StoneDrill has used the WMI command-line (WMIC) utility to run tasks.
Stuxnet used WMI with an explorer.exe token to execute on a remote share.
SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.
SVCReady can use WMI queries to detect the presence of a virtual machine environment.
SysUpdate can use WMI for execution on a compromised host.
It has used WMI to query targeted systems for security products.
A It tool can use WMI to execute a binary.
Ursnif droppers have used WMI classes to execute PowerShell commands.
Valak can use wmic process call create in a scheduled task to launch plugins and for execution.
It has leveraged WMIC including for execution and remote system discovery.
WannaCry utilizes wmic to delete shadow copies.
It has used WMI to collect information about target machines.
It has used WMI and LDAP queries for network discovery and to move laterally. It has also used batch scripts to leverage WMIC to deploy ransomware.
One variant of Zebrocy uses WMI queries to gather information.