So I've seen some talks on using WMI for some pretty cool attacks.
There was a Black Hat talk in 2015 about it where a guy
had used it for blue team and red team,
but established persistence and then monitored that box for WMI commands.
We had talked before,
WMI can also be used for these kind of fileless attacks
that push stuff straight into memory.
Can you speak to that a little bit?
Yeah.
So WMI, or Windows Management Instrumentation, has been around forever.
I remember using it when I had, when I just got my Windows XP box way,
way too long ago that we won't talk about,
and I think it's even been around since like Windows 2000.
So it's essentially another management interface for administrators.
WMI is extremely powerful just like PowerShell is.
You can do a lot.
And one of the ways that attackers use WMI is,
well, they use it to execute commands.
You can execute commands directly through WMI.
You can even execute commands if they're hidden essentially.
You can use it to read the registry, to modify the registry.
You can use it to interact with services,
with the networking infrastructure within Windows.
I mean, there's just so much you can do with it.
Yeah, I've even used it to modify BIOS settings.
Yes, exactly.
And WMI is not just limited to the system it's on.
Just like PowerShell has remoting,
there's also WMI remoting so that you can actually execute commands,
WMI commands, on other systems as long as you have the right credentials,
and that's how attackers sometimes laterally move within an organization.
So yeah.
Like if when RM has been configured on the box, you now have remote capability.
Yeah, a user, or I'm sorry, an attacker if they get on the box,
probably what they're going to do is their going to load something
like Mimikatz on it to grab the credentials out of memory and then use
WMI to pivot throughout the environment.
I, in my current job, I work with pen testers.
With the company that I work for, we do a lot of pen testing,
and so I get to see all the backend conversations that are happening.
And the pen testers are absolutely using this.
The first thing when they do when they get on there is
they dump passwords if they can, and then they use WMI,
or PowerShell, or something along those lines to pivot through the environment,
and they're using the exact same techniques that the attackers are doing.
So it's not just the people coming into your network
to test it that they're using this.
They're emulating the attackers, and so this is real-life stuff.
This is stuff that's happening every day.
Yeah,
so that's kind of a unique work environment too and
hopefully something that we're towards, kind of purple team.
It is, and that's exactly what's going on here is the red teamers are coming in,
they're doing the pen testing, they're using these fileless techniques,
and then they sit down with the defense,
and they go through and they show them alright well,
here is how you could have detected it.
This is what you need to turn on in order to detect it and so on,
and that helps us as defenders protect ourselves and our organizations.
Yeah.
That's kind of an awesome cycle of upgrade.
Like Cyber threat emulation, and then you're like hey,
here's where you didn't catch it, and here's how you could.
And then you come in as the blue team and figure out hey,
let's help you set up to be able to detect this next time.
Yeah, exactly.
Very cool.
With WMI still though, there is still so much more you can do.
With PowerShell, when we talked about that,
it's very powerful, but there's no way for you to set up persistence,
for the attacker to set up persistence on the network,
within PowerShell itself.
I mean, there are a couple of ways, but they're not very easy.
And typically, what attackers will do is they'll go to the registry,
and in the persistence keys within the registry,
like the Windows current version or Microsoft
Windows--- The control set of the run key.
---yeah, yeah, the run key.
They'll set up a PowerShell command in there.
Well, that's easily detectable.
Everybody knows that.
You can download Autoruns from Microsoft,
and that's the first thing that everybody learns to check.
WMI itself can set up its own persistence,
and it becomes a little bit more difficult to check
because not everybody thinks to check WMI.
And so, within MI, you can set up things called event subscriptions,
and these are essentially, they're composed of three parts.
There is the consumer, which is the action that's going to perform,
that's going to be performed,
when you know what the script that's going to be run,
the WMI commands that are going to be run,
and so on.
There's the filter, which is when is it going to do this?
Is it going to run the consumer when somebody logs on,
or every 5 minutes, or when the system gets shutdown.
The timing of it.
There are lots of different times when the filter can go off.
And then the binding, which really just what takes the consumer,
the filter, and kind of connects them together.
And well, the advantage to this is whenever you set up an event subscription,
you have to have administrative privileges on the system first off to do this,
or elevated privileges, which for attackers,
is not always that difficult to get.
So you're in Mimikatz, and now you're on--- Exactly.
You run Mimikatz, you've elevated your privileges,
and you've set up this WMI subscription.
Well, when the subscriptions are executed,
they're often executed either as system or as a local service,
the elevated user accounts already,
depending on what operating system you're using.
And so if an attacker can set up one of these event subscriptions,
then they will, as soon as that get off,
they're already at a higher level of privilege on the system,
perhaps even the highest level of privilege that they can get to.
And so you can just imagine when attacker gets that,
that's like the ultimate for them.
They can do anything on the system.
That's why they call it owning the system.
They can do anything they want.
It's not your system anymore.
So that's pretty neat too because that's kind of a legacy like WMI is legacy.
I know SIEMs come in, SIEM objects are being phased in,
but it's essentially the same functionality.
But being able to use this legacy tool that no one really thinks to
check with a lot of the same capabilities sounds like as Task
Scheduler and as like normal persistence methods,
but kind of go in undetected.
And the same thing as this can also be ran
in-memory is what we're talking about.
Yeah, when you run a WMI, it does put some things in files.
There are certain directories, especially for, with event subscriptions.
It's going store--- It has to be somewhere.
---yeah, it has to be somewhere.
It's going to store those as a file under Windows.
But when the attackers are using WMI commands themselves to pivot
around the environment or run other programs,
they will do that, and it's all in-memory.
And honestly, there's very little logging that occurs with WMI by default.
Yeah.
I mean, I don't recall even seeing any.
No, it's usually, by default,
you only see any error messages that occur when WMI occurs,
when WMI commands go off.
Now there are other tools that we're going talk about that you can
use to kind of enhance the WMI logging that go on.
So it is possible, but again, it's not by default.
You have to go in and purposely set this stuff up.
So this is intentional security monitoring.
Right exactly.