MITRE ATT&CK detection coverage

← Back to main site

Home/ MITRE Matrix/ Execution/ T1047

T1047Windows Management Instrumentation

T1047 — Windows Management Instrumentation is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 22 detection use cases covering it and 7 threat-intel articles citing it.

Execution

View on the matrix → Filter Detection Library MITRE official spec ↗

22Use cases

7Articles

0Sub-techniques

1Tactic

Use cases covering this technique (22)

Impacket Lateral Movement Commandline Parameters ESCU actions · alerting P Impacket Lateral Movement smbexec CommandLine Parameters ESCU actions · alerting P Impacket Lateral Movement WMIExec Commandline Parameters ESCU actions · alerting P Possible Lateral Movement PowerShell Spawn ESCU actions · hunting P PowerShell Invoke CIMMethod CIMSession ESCU actions · hunting P PowerShell Invoke WmiExec Usage ESCU actions · alerting P Process Execution via WMI ESCU actions · alerting P Remote Process Instantiation via WMI ESCU actions · alerting P Remote Process Instantiation via WMI and PowerShell ESCU actions · alerting P Remote Process Instantiation via WMI and PowerShell Script Block ESCU actions · alerting P Remote WMI Command Attempt ESCU actions · alerting P Script Execution via WMI ESCU actions · alerting P Windows WinRAR Launched Outside Default Installation Directory ESCU actions · hunting P Windows WMI Impersonate Token ESCU actions · hunting P Windows WMI Process And Service List ESCU actions · hunting P Windows WMI Process Call Create ESCU actions · hunting P Windows WMI Reconnaissance Class Query ESCU actions · hunting P WMI Permanent Event Subscription ESCU actions · alerting P WMI Temporary Event Subscription ESCU actions · alerting P Wmiprvse LOLBAS Execution Process Spawn ESCU actions · alerting P Wmiprsve LOLBAS Execution Process Spawn ESCU actions · alerting P [LLM] LoLBin abuse: certutil decode/urlcache, bitsadmin transfer, wmic process-call-create Bespoke install · hunting DSΣPDDCS

Articles citing this technique (7)

crit TELESHIM Abuses Telegram for C2 in Attacks Against Middle East Governments art-66

crit UAT-11795 deploys novel Starland RAT and bespoke WLDR C2 implant in financially motivated campaign art-156

crit No Manners Here: The Ruthless Rise of The Gentlemen Ransomware art-198

crit Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign art-250

crit Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects art-265

crit Webworm: New burrowing techniques art-413

crit GlassWorm Hides a RAT Inside a Malicious Chrome Extension art-580