Loading story…
Researchers highlighted how Windows Management Instrumentation (WMI) can be abused to establish stealthy, fileless persistence on Windows systems and to support remote execution across an enterprise. Black Hat research detailed the use of permanent WMI event subscriptions, asynchronous event consumers, and WMI-based backdoors that can survive reboots while leaving limited traditional malware artifacts on disk.
Follow-on research showed WMI remains relevant for lateral movement because it provides native access to remote process creation, system management, and execution through trusted Windows components. The combined findings reinforce that defenders should treat unusual WMI activity, remote WMI execution, and unauthorized event subscription creation as high-priority indicators of compromise in environments where attackers seek persistence and post-compromise mobility.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
A Security Friends' Research Blog post examined WMI research and lateral movement techniques, reflecting continued public analysis of WMI abuse in offensive operations.
A Black Hat USA 2015 paper by Matt Graeber documented how Windows Management Instrumentation could be abused to build a persistent, asynchronous, fileless backdoor, establishing a notable public milestone in WMI abuse research.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent research shows attackers continue to rely on legitimate Windows administration features for lateral movement, with WMI, Scheduled Tasks, SMB admin shares, RDP, PsExec, and anomalous Kerberos activity remaining common across enterprise intrusions. VMware telemetry covering 489 multi-host intrusions found **44.7%** included lateral movement, typically across fewer than 20 hosts and using short, focused paths, while Gigamon detailed how remote WMI execution and Scheduled Tasks often blend into normal administration through DCE/RPC operations such as `ExecMethod`, `SchRpcRegisterTask`, `SchRpcRun`, and `SchRpcDelete`, frequently paired with SMB payload transfer and shared outbound command-and-control destinations. Newer Windows tradecraft is also exploiting **cross-session activation** and service manipulation to execute code under another user’s interactive session or persist more stealthily after compromise. Purple Team research described COM/DCOM abuse using `RunAs=Interactive User`, remote registry changes, and CLSID hijacking—including abuse of **SpeechRuntime.exe** via the CLSID `{655D9BF9-3876-43D0-B6E8-C83C1224154C}`—as well as tooling such as COMThanasia, PermissionHunter, SessionHop, and SpeechRuntimeMove; separate analysis showed attackers can evade simpler detections by abusing Windows Service recovery functions and registry-backed service creation. Across these techniques, defenders are urged to correlate process creation, registry access, service state changes, authentication context, and network telemetry, with attention to Windows events including **4688**, **4663**, **4657**, **7036**, and **7040**.
Aug 15, 2026
Threat actors are increasingly leveraging built-in Windows features to establish persistence and evade detection on compromised systems. Common persistence mechanisms include the abuse of registry keys, scheduled tasks, and Windows Management Instrumentation (WMI), which allow malware to survive reboots and maintain long-term access. These techniques often exploit legitimate system administration tools, making it challenging for defenders to distinguish malicious activity from normal operations. Security teams are advised to proactively hunt for indicators of compromise (IOCs) associated with these persistence methods, as even fileless malware can leave traces in system configurations or memory. Fileless malware represents a significant evolution in attack methodology by operating entirely in memory and utilizing trusted Windows binaries such as PowerShell, MSHTA, and rundll32. This approach enables attackers to bypass traditional signature-based antivirus solutions, as no malicious files are written to disk. Persistence for fileless malware can be achieved by embedding encoded scripts or commands within the Windows Registry, WMI, or Task Scheduler, allowing the malware to re-execute at startup without leaving conventional artifacts. Defenders must adapt detection strategies to monitor for unusual use of native tools and changes in system persistence mechanisms to effectively counter these threats.
Jun 29, 2026
SpecterOps research highlighted that **Windows Subsystem for Linux 2 (WSL2)** can be abused as a stealthy execution and persistence layer on Windows endpoints because each WSL2 distribution runs as its own **Hyper-V VM** with a separate Linux filesystem and processes. Attackers can inject a beacon object file into an installed WSL2 distro to execute arbitrary commands, read files, and pivot into a Linux environment while many endpoint tools primarily observe only a short-lived `wsl.exe` process on the Windows side. The research also noted that the `$WSL` share and in-guest activity may not be scanned or instrumented by multiple security products, degrading common alerting rules and enabling longer dwell time and harder incident investigations. Operationally, this tradecraft allows intruders to run Linux utilities “out of sight” of traditional Windows-focused telemetry, potentially supporting internal reconnaissance, lateral movement, credential access, and data staging from within the WSL2 guest while maintaining access to corporate resources. The reporting recommends expanding defensive coverage to include **WSL2 activity monitoring and logging** (beyond `wsl.exe` process starts) to reduce blind spots created by the Windows/Linux boundary and to improve detection of malicious tooling and persistence inside WSL2 distributions.
Jun 29, 2026