Threat Intelligence & APT BleepingComputer 1 month ago

Microsoft starts removing WMIC tool used by cybercriminals

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week. WMIC is a legacy built-in Windows command-line utility that helps interact with the Windows Management Instrumentation (WMI) system using text commands. This move is part of a process announced in September ,..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

WMIC

Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.

WMIC is a legacy built-in Windows command-line utility that helps interact with the Windows Management Instrumentation (WMI) system using text commands.

This move is part of a process announced in September, when the company said that WMIC will be removed after upgrading to Windows 11 25H2 and later.

image

Microsoft deprecated WMIC in Windows Server 2012 (in 2016) and Windows 10 21H1 (in 2021), and it converted it into a Feature on Demand (FoD) starting with Windows 11 22H2 (in 2022), and announced in January 2024 that it would be removed altogether after first disabling it by default.

"Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows," Microsoft noted on Monday.

Three days earlier, on Friday, it also revealed that the tool is "already removed by default in new installations of Windows 11, versions 24H2 and 25H2, and is no longer available as a Feature on Demand (FoD)."

Get the report

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →