delenv

Overview

The delenv action removes environment variables from local and remote systems using the Win32_Environment WMI class. This is essential for cleanup after operations and removing persistence markers.

Syntax

SharpWMI.exe action=delenv name=VARIABLE_NAME [computername=HOST[,HOST2,...]] [username=DOMAIN\user] [password=Password]

Parameters

Parameter	Required	Description
`action`	Yes	Must be `delenv`
`name`	Yes	Environment variable name to delete
`computername`	No	Target host(s), comma-separated. Defaults to localhost
`username`	No	Username for authentication
`password`	No	Password for authentication

Usage Examples

SharpWMI.exe action=delenv name=TEST

SharpWMI.exe action=delenv name=CONFIG computername=target.domain.com

SharpWMI.exe action=delenv name=API_KEY computername=target.domain.com username="DOMAIN\admin" password="Password123!"

SharpWMI.exe action=delenv name=PAYLOAD computername=server1,server2,server3

Operational Use Cases

Scenario 1: Cleanup After Operations

# 1. Use variable for operation
SharpWMI.exe action=setenv name=TEMP_DATA value="<operational_data>" computername=target.domain.com

# 2. Execute using the variable
SharpWMI.exe action=exec computername=target.domain.com command="payload.exe"

# 3. Clean up
SharpWMI.exe action=delenv name=TEMP_DATA computername=target.domain.com

Scenario 2: Remove Command Output

# Command output was stored in environment variable (via exec with result=true)
# Clean up after retrieval
SharpWMI.exe action=delenv name=_Context123456 computername=target.domain.com

SharpWMI automatically cleans up environment variables used for command output retrieval. Manual cleanup is only needed if operations fail or for custom variables.

Scenario 3: Remove Persistence Markers

# Remove indicators of compromise
SharpWMI.exe action=delenv name=SYSTEM_ID computername=target.domain.com
SharpWMI.exe action=delenv name=C2_SERVER computername=target.domain.com
SharpWMI.exe action=delenv name=IMPLANT_CONFIG computername=target.domain.com

Scenario 4: Batch Cleanup

# Clean up across multiple systems
SharpWMI.exe action=delenv name=BUILD_NUMBER computername=ws01,ws02,ws03,ws04 username="DOMAIN\admin" password="Password123!"

User Context

The delenv action deletes variables in the user context. Variables must match both name and username to be deleted.

Variables are user-specific:

System variables require SYSTEM context
User variables are tied to specific username
Cannot delete other users’ variables without proper context

Remote vs Local Usage

Local Delete
Remote Delete

SharpWMI.exe action=delenv name=TEST

Use for:

Local cleanup
Testing
Post-operation tidying

SharpWMI.exe action=delenv name=TEST computername=target.domain.com

Use for:

Remote cleanup
Removing indicators
Multi-system operations

Detection Considerations

WMI Detection

Win32_Environment class deletions
Event ID 5857: WMI activity
Sysmon Event ID 19-21: WMI operations
Environment variable removal

Registry Detection

Registry deletions in environment key
HKCU\Environment changes
Event ID 4657: Registry value modification/deletion

Cleanup Patterns

Suspicious variable deletion
Bulk deletion operations
Deletion of recently created variables
Cleanup correlated with other activity

Best Practices

Always Clean Up

Remove variables after use
Don’t leave indicators
Clean up on operation failure
Automate cleanup in scripts

Verify Deletion

Confirm variable was deleted
Check with getenv action
Handle errors gracefully
Log cleanup operations

Operational Security

Clean up immediately after use
Don’t leave data in environment
Remove all custom variables
Check for orphaned variables

Error Handling

Handle variable not found
Verify admin privileges
Account for permission issues
Retry on failure

Cleanup Workflow

Complete cleanup example:

# 1. List all custom variables
SharpWMI.exe action=getenv computername=target.domain.com

# 2. Delete custom variables
SharpWMI.exe action=delenv name=CONFIG computername=target.domain.com
SharpWMI.exe action=delenv name=API_KEY computername=target.domain.com
SharpWMI.exe action=delenv name=PAYLOAD computername=target.domain.com

# 3. Verify deletion
SharpWMI.exe action=getenv name=CONFIG computername=target.domain.com

Troubleshooting

Variable Not Found

Cause: Variable doesn’t exist or wrong user contextSolution:

Verify variable exists with getenv
Check variable name spelling
Ensure correct user context
Variable may have been already deleted

Access Denied

Cause: Insufficient privilegesSolution:

Use username and password parameters
Verify admin rights on target
Check UAC remote restrictions
May need SYSTEM context for system variables

Permission Denied for User Variable

Cause: Trying to delete another user’s variableSolution:

Variables are user-specific
Must authenticate as that user
Or use SYSTEM context
Cannot delete other users’ variables directly

getenv

Retrieve environment variables

setenv

Set environment variables

query

Query Win32_Environment directly

exec

Execute cleanup commands

Alternative Methods

Delete via PowerShell

# Delete using exec action with PowerShell
SharpWMI.exe action=exec computername=target command="powershell -c \"[Environment]::SetEnvironmentVariable('VARNAME',$null,'User')\"" result=true

Delete via Registry

# Delete using registry
SharpWMI.exe action=exec computername=target command="reg delete HKCU\Environment /v VARNAME /f" result=true

Verification

After deletion, verify the variable is gone:

# Check if variable still exists
SharpWMI.exe action=getenv name=VARNAME computername=target.domain.com

# Should return no results or "Variable not found"

Getting Started

Enumeration Actions

Execution Actions

File Operations

Environment Variables

Overview

Syntax

Parameters

Usage Examples

Operational Use Cases

Scenario 1: Cleanup After Operations

Scenario 2: Remove Command Output

Scenario 3: Remove Persistence Markers

Scenario 4: Batch Cleanup

User Context

Remote vs Local Usage

Detection Considerations

Best Practices

Always Clean Up

Verify Deletion

Operational Security

Error Handling

Cleanup Workflow

Troubleshooting

getenv

setenv

query

exec

Alternative Methods

Verification

​Overview

​Syntax

​Parameters

​Usage Examples

​Operational Use Cases

​Scenario 1: Cleanup After Operations

​Scenario 2: Remove Command Output

​Scenario 3: Remove Persistence Markers

​Scenario 4: Batch Cleanup

​User Context

​Remote vs Local Usage

​Detection Considerations

​Best Practices

Always Clean Up

Verify Deletion

Operational Security

Error Handling

​Cleanup Workflow

​Troubleshooting

​Related Actions

getenv

setenv

query

exec

​Alternative Methods

​Verification

Overview

Syntax

Parameters

Usage Examples

Operational Use Cases

Scenario 1: Cleanup After Operations

Scenario 2: Remove Command Output

Scenario 3: Remove Persistence Markers

Scenario 4: Batch Cleanup

User Context

Remote vs Local Usage

Detection Considerations

Best Practices

Cleanup Workflow

Troubleshooting

Related Actions

Alternative Methods

Verification