> For the complete documentation index, see [llms.txt](https://www.ired.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.ired.team/offensive-security/lateral-movement/t1047-wmi-for-lateral-movement.md).

# WMI for Lateral Movement

## Execution

Spawning a new process on the target system 10.0.0.6 from another compromised system 10.0.0.2:

{% code title="attacker\@victim" %}

```bash
wmic /node:10.0.0.6 /user:administrator process call create "cmd.exe /c calc"
```

{% endcode %}

## Observations

![](/files/-LI2YnLFrMYHVXmrLb6E)

Inspecting sysmon and windows audit logs, we can see `4648` logon events being logged on the source machine as well as processes being spawned by `WmiPrvSe.exe` on the target host:

![](/files/-LI2cZGIbNEPteMiwa5J)

![](/files/-LI2ca0impieLYNRCoj6)

![](/files/-LI2cbynNlqXXCT96Iod)

Both on the host initiating the connection and on the host that is being logged on to, events `4624` and `4648` should be logged:

![](/files/-LII9yVSKAg6p1rQDI99)

## References

{% embed url="<https://attack.mitre.org/wiki/Technique/T1047>" %}