Skip to main content

​
Overview

The WMI command allows you to run custom WMI (Windows Management Instrumentation) queries against the system. WMI provides extensive access to system configuration and state data, making it a powerful reconnaissance tool. This command requires you to specify the WMI query as an argument.

​
Syntax

# Specify WMI query
Seatbelt.exe "WMI <query>"

# Example queries
Seatbelt.exe "WMI SELECT * FROM Win32_Process"
Seatbelt.exe "WMI SELECT * FROM Win32_Service WHERE State='Running'"
Seatbelt.exe "WMI SELECT * FROM Win32_Product"

​
Remote Execution

Seatbelt.exe "WMI <query>" -computername=TARGET.domain.com [-username=DOMAIN\user -password=pass]

​
Output

Returns results based on the specified WMI query. Output format depends on the queried WMI class and properties.

​
Use Cases

  • Red Team
  • Blue Team
  • Execute custom reconnaissance queries
  • Enumerate installed software via Win32_Product
  • Query running processes and services
  • Discover system hardware configuration
  • Extract detailed system information
  • Identify security products

​
Common WMI Queries

  • System Info
  • Software
  • Network
  • Security
Win32_OperatingSystem
Win32_ComputerSystem
Win32_BIOS
Win32_Processor
Win32_PhysicalMemory

​
Example Output

====== WMI ======

[*] Running WMI Query: SELECT Name, ProcessId, ExecutablePath FROM Win32_Process WHERE Name LIKE '%sql%'

Name                : sqlservr.exe
ProcessId           : 2156
ExecutablePath      : C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Binn\sqlservr.exe

Name                : sqlwriter.exe
ProcessId           : 3492
ExecutablePath      : C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

​
Remote Execution

This command supports remote execution using the -computername parameter.
Remote WMI queries connect to the target system’s WMI service over RPC/DCOM.

​
Detection Considerations

WMI queries generate significant detection opportunities.
  • WMI Activity: Generates WMI-Activity/Operational logs (Event ID 5857-5861)
  • Network Traffic: Remote WMI over RPC (port 135 + dynamic ports)
  • Process Creation: WMI Provider hosts may spawn
  • Event Logs: WMI queries can be logged
  • Sysmon: Event ID 19-21 (WMI events)

​
Defensive Recommendations

WMI Logging:
  • Enable WMI-Activity/Operational log
  • Monitor Event ID 5857 (WMI queries)
  • Track WMI provider loads
Network Detection:
  • Monitor RPC connections (port 135)
  • Track DCOM activity
  • Alert on remote WMI connections
Query Patterns:
  • Suspicious WMI classes (Win32_Product is slow/noisy)
  • Reconnaissance queries (process, service, software enumeration)
  • Persistence queries (Event consumers, filters)
Sysmon Detection:
  • Event ID 19: WMI event filter activity
  • Event ID 20: WMI event consumer activity
  • Event ID 21: WMI event consumer to filter binding