CC performing-lateral-movement-with-wmiexec

# WMI Lateral Movement Report Template

# API Reference — Performing Lateral Movement with WMIExec

- **impacket** (external): wmiexec.py for authorized lateral movement testing

Uses Impacket wmiexec for authorized penetration testing.

# Standards and References - WMIExec Lateral Movement

| T1021.003 | Remote Services: DCOM | Lateral Movement |

| T1550.002 | Use Alternate Authentication Material: Pass the Hash | Lateral Movement |

| T1570 | Lateral Tool Transfer | Lateral Movement |

# Workflows - WMIExec Lateral Movement

## Lateral Movement Chain

1. Initial Compromise → Credential Harvesting → WMIExec to target

description: Perform lateral movement across Windows networks using WMI-based remote

commands for stealthy post-exploitation during red team engagements.

# Performing Lateral Movement with WMIExec

WMI (Windows Management Instrumentation) is a legitimate Windows administration framework that red teams abuse for lateral movement because it provides remote command execution without deploying addit

- When conducting security assessments that involve performing lateral movement with wmiexec

QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win3…tem'"}