Skip to content

WMIC

Named by 2 kept items in this workspace.

Search every workspace for WMIC. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • It’s Not Safe To Pay SafePa
    writeup2026-07-17

    Used by the threat actor to delete shadow copies (shadowcopy delete) to hinder recovery.

  • Defence Impairment Olympics
    writeup2026-06-29

    Used by the threat actor to create Microsoft Defender exclusions and to stop the ImmunetProtect service

All technologies in this workspace.