Execute commands on remote Windows systems via DCOM/RPC. No file writes, no service creation. Stealthier than PSExec.
WMI (Windows Management Instrumentation) is a legitimate Windows administration protocol that attackers abuse for remote code execution and lateral movement.
Unlike PSExec which uses SMB, WMI uses DCOM/RPC (TCP 135, 49152-65535) to execute processes on remote systems without writing files or creating services.
Remote Code Execution via DCOM/RPC
Requires: Valid credentials • Difficulty: Intermediate • Impact: High
💻 Desktop Experience Available
View this module on desktop for an interactive WMI Execution lateral movement simulation.
WMI Execution (Windows Management Instrumentation) is a legitimate Windows administration protocol that attackers abuse for remote code execution and lateral movement. Unlike PSExec which uses SMB, WMI uses DCOM/RPC (TCP 135, 49152-65535) to execute processes on remote systems.
Attackers use WMI with compromised credentials to execute commands remotely. WMI execution leaves fewer forensic artifacts than PSExec—no file writes, no service creation. It's a "living off the land" technique that's harder to detect.
Why It's Effective: WMI is a core Windows component, always enabled. It uses different ports than SMB, potentially bypassing network restrictions. No files written to disk, no services created—makes detection more difficult than PSExec.
WMI Execution techniques should only be used in authorized penetration testing, red team engagements, or controlled lab environments. Unauthorized access to computer systems is illegal under CFAA and equivalent laws worldwide. Always obtain written permission before testing.
Execute commands on remote Windows systems via DCOM/RPC. No file writes, no service creation. Stealthier than PSExec.
DCOM/RPC (TCP 135, 49152-65535)
Using credentials: CORP\admin
WMI connects to remote systems via DCOM/RPC (TCP 135, 49152-65535), uses Win32_Process.Create() to execute commands, and retrieves output. No files written, no services created—stealthier than PSExec.
WMI execution is stealthier than PSExec because it doesn't write files or create services. However, it requires DCOM/RPC access, which may be blocked by network segmentation.