WMIC.exe
Summary
WMIC (Windows Management Instrumentation Command-line) is a command-line interface to WMI, providing access to system information, process management, and remote administration capabilities. Microsoft has deprecated WMIC as of Windows 11, recommending PowerShell as the replacement for WMI queries.
WMIC.exe is the 37th most commonly executed Windows program in EchoTrail's dataset, observed 1,045,753 times across enterprise environments. It typically runs from C:\Windows\System32\wbem and it is most often launched by cmd.exe.
Behavior
Top Paths
- C:\Windows\System32\wbem98.55%
- C:\Windows\SysWOW64\wbem1.45%
Top Hashes (SHA256)
- a23c1b94d193ebe3d4cf647c653e41f63ba7b6d996c9a3de6380408c7e4a812e43.32%
- 69fe210903c3f03436fe9f00a493cdb822a64ea17a5729593bbe9ec3e0763c1b21.94%
- fa78c88dac91fdf2eac736e6900ac1ec4ab7a388b8f77a23ffa7e80a4ad29f5a14.52%
- 74d21e1349aab027cd02d15f2428028c028592f265d1830c8dfc407f9bf7617312.82%
- 6679ea8fbeb539b5852ce8838420471fed0600f5050f3370dbb355dac76bf0721.78%
- d368bcb7934db0c53d1e7277dcb47af2b709253cbf0eee9869ee7e17ed226ea31.72%
- da3ad32583644bd20116f0479c178f7c7c0b730728f4c02a438c0d19378c83d91.39%
- 12abb45620a7a1ffd8bb953deba3fcc30b8ba14b2ff523f1f519bf2bf6ba7d4c1.29%
- 3257cab2b2c03b9fc11f1b478ac25279df72a00f515166ed3999a517139cdd990.49%
- 0cde337426e339fdf0518400c6302e5068768ffacc9cfac81be820f8dcfbf9440.07%
Process Ancestry
Top Grandparents
- LTSVC.exe82.54%
- services.exe17.3%
- jumpcloud-agent.exe0.05%
- explorer.exe0.03%
- 32bitProxy.exe0.02%
- Asusgiftbox.exe0.01%
- cncmd.exe0.01%
- runkbot.exe0.01%
- cmd.exe<0.01%
- CCXProcess.exe<0.01%
Top Parents
- cmd.exe80.27%
- powershell.exe7.88%
- svchost.exe1.56%
- LogiBolt.exe0.03%
- Code.exe0.02%
- GoogleDriveFS.exe0.01%
- RadeonSettings.exe0.01%
- FortiClient.exe0.01%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does WMIC.exe normally do?
Located in C:\Windows\System32\wbem or C:\Windows\SysWOW64\wbem. Commonly launched by cmd.exe, powershell.exe, or management agents (Amazon SSM Agent). Typically spawns conhost.exe. Used for querying system information, managing processes and services, and remote administration.
When is WMIC.exe suspicious?
Running from any path outside the wbem directories. Process creation commands (wmic process call create). Remote execution targeting other hosts (/node: parameter). XSL script processing (wmic os get /format:). Spawned by unusual parents like Office applications, w3wp.exe, or mshta.exe. Rapid sequential execution suggesting enumeration scripts.
How do attackers abuse WMIC.exe?
System reconnaissance: attackers query OS version, installed software, running processes, network configuration, and user accounts via wmic. Remote process execution: wmic /node:<target> process call create allows execution on remote systems, generating wmiprvse.exe activity on the target. XSL script processing: wmic can load and execute XSL stylesheets containing JScript or VBScript, bypassing application whitelisting. Lateral movement: combined with stolen credentials, wmic enables remote command execution without deploying additional tools.
Detection guidance
High-confidence: wmic with /node: parameter (remote execution). wmic with process call create (process creation). wmic with /format: pointing to remote or unusual XSL files. Medium-confidence: wmic spawned by Office applications, mshta.exe, or script interpreters. Correlate with wmiprvse.exe activity on remote hosts when /node: is detected. Monitor for Sysmon Event ID 1 with command-line arguments.
False positive notes
Management agents (Amazon SSM Agent, SCCM) frequently use wmic for inventory and health checks. System administrators use wmic for legitimate remote management. Some monitoring tools query wmic for system information at regular intervals.
Related Processes
Ask Rocky about WMIC.exe
Rocky answers questions about WMIC.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.