D2T1 - Expanding Your WMI Lateral Movement Arsenal
summary
Demonstrates concrete WMI lateral techniques that avoid Win32_Process create and beat common network IDS by changing execution vectors: class derivation to spawn processes via a Win32_not_evil_at_all class derivation, creating services and scheduled tasks through Win32_Service / PS_ScheduledTask over WMI instead of RPC service calls, remote MSI execution via Win32_Product install, and registering a COM LocalServer32 to force-load a provider as SYSTEM; demos succeed and ETW WMI activity plus WMI introspection are recommended detections.
AI-written summary · about
chapters (11)
- 0:00Introduction and about me
- 3:02What is lateral movement
- 5:30What is WMI
- 9:46WMI lateral movement basics
- 11:10Class derivation evasion
- 17:02Forcing old methods through WMI
- 23:34Win32 product for lateral movement
- 27:57Evil WMI providers
- 38:23Messing with boot configuration
- 41:42Detection methods
- 43:52Closing and Q&A
related talks
39mWindows Agentless C2: (Ab)using the MDM Client Stack
50mThe Beast Within - Evading Dynamic Malware Analysis Using Microsoft COM
58mRed Team Techniques for Evading, Bypassing & Disabling MS
50mNetwork Defender Archeology: An NSM Case Study in Lateral Movement with DCOM
49mLost in Transaction: Process Doppelgänging
38mCatch Me If You Can. LOLBins and the Adversaries Who Abuse Them
40mBeyond Living-Off-the-Land: Why XP Exploits Still Matter
35mLifting the Fog of War - Monitoring, Identifying and Mitigating MS-RPC Based Threats