🧰 WMI

The items that name it 17

• Field Notes: Reconstructing an Attacker’s Workflow
  writeupas classification.technologies2026-10-22
• Defender Exclusion Abuse: How Attackers Hide Malware from MDAV
  writeupas tools2026-09-30It is written here as WMI (MSFT_MpPreference Class).

  WMI class used to add MDAV exclusions, e.g. via Invoke-CimMethod with the Add method and ExclusionPath argument

• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
  writeupas tools2026-09-28

  Used by the RAT to enumerate installed antivirus products during host reconnaissance.

• DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer
  writeupas classification.technologies2026-09-22
• Socket: 11 Malicious NuGet Tools Pose as Game Cheats
  writeupas tools2026-07-15

  Queried by the payload to enumerate keyboard and mouse device names

• LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
  articleas tools2026-07-08

  Windows Management Instrumentation, built-in admin capability cited as commonly abused for LoTL activity

• Lateral Movement Attack: Techniques, Detection & Prevention
  writeupas classification.technologies2026-07-01
• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas classification.technologies2026-06-08
• Inside .NET Loader Analysis: From Malspam to In-Memory Loader
  writeupas tools2026-06-03It is written here as WMI (Windows Management Instrumentation).

  Used by loader for AV product enumeration, hardware fingerprinting, and GPU detection

• ClickFix Removes Your Background but Leaves the Malware
  writeupas tools2026-04-30It is written here as WMI (Win32_OperatingSystem, Win32_Processor, Win32_VideoController, Win32_ComputerSystem).

  Used for host fingerprinting/reconnaissance by the stealer

• When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk
  writeupas classification.technologies2026-04-14
• Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
  writeupas tools2026-04-07

  Native Windows utility ('LOLBin') publicly reported as used in other NightSpire attacks, though not observed in the incident Huntress investigated

• Dissecting CrashFix: KongTuke's New Toy
  writeupas tools2026-01-16It is written here as WMI (Win32_VideoController, Win32_CacheMemory, SecurityCenter2).

  Queried by the malware for VM/hardware fingerprinting (AdapterDACType, cache purpose field) and to enumerate installed antivirus products.

• Manual Configuration Manager (SCCM) credential harvesting
  writeupas classification.technologies2025-10-05
• LOLBins: What are they & How to Detect Them
  articleas tools2025-01-09

  Used to create and manage user accounts on Windows endpoints

• Sigma r2026-07-01 — 20 new detection rules
  repoas classification.technologies
• DEF CON® 34 Hacking Conference - Main Stage Talks
  otheras classification.technologies