WMI lateral movement

Windows Management Instrumentation (WMI) is Windows' remote management subsystem. With valid local-administrator credentials on another machine, WMI lets us run commands remotely without dropping a binary on disk or creating a service, which makes it stealthier than PsExec. It is one of the cleanest lateral-movement paths inside a domain: it relies on legitimate Windows protocols and inherits the context of the authenticated user, not SYSTEM, so it generates less noise for anyone hunting the intrusion.

Mechanism

WMI communication always starts on TCP 135 (RPC/DCOM) and then moves to a dynamic high port. From Linux, Impacket's wmiexec.py gives a semi-interactive shell over WMI with a username and password:

wmiexec.py <domain>/<user>:'<pass>'@<ip>

If we do not have the password but do have the NT hash, WMI fits Pass-the-Hash. Invoke-WMIExec (from Invoke-TheHash, in PowerShell) runs a command passing only the hash:

Invoke-WMIExec -Target <host> -Domain <domain> -Username <user> -Hash <hash> -Command "<command>"

And with a Kerberos ticket (Pass-the-Ticket), wmiexec.py authenticates without a password using the cached TGT/TGS:

KRB5CCNAME=<ticket>.ccache wmiexec.py -k -no-pass <host>

netexec (formerly CrackMapExec) can also execute over WMI by choosing the method (--exec-method wmiexec), handy for firing the same command against several hosts at once.

Requirements

Credentials (password, NT hash or Kerberos ticket) for an account that is a local administrator on the target, and that port 135 plus the dynamic RPC range be reachable (often you must cross the network with a dynamic proxy). Without local admin rights, WMI grants no execution.

How to detect it. The abuse is given away by child processes of WmiPrvSE.exe (the WMI provider host) spawning cmd.exe or powershell.exe, the 4688 events with that tree, and network activity to 135 followed by a high port. wmiexec.py additionally writes output to an ADMIN$ share via a temporary file name, another useful signal. The associated logon is usually type 3 (network) with the reused account.

Defence. Restrict who is local administrator (LAPS and tiering), segment RPC/135 with the firewall, require signing and watch children of WmiPrvSE.exe; and reduce the credential reuse that enables the hop. It is the stealthy alternative to PsExec within Pass-the-Hash and fits Overpass-the-Hash and Pass-the-Ticket; it usually follows dumping hashes with Mimikatz and exploiting credential reuse.