Loading story…
Microsoft has removed the legacy Windows Management Instrumentation Command-line utility, WMIC, from Windows 11 versions 24H2 and 25H2, including recent beta builds, as part of a multi-year deprecation effort. The company said WMIC is no longer included in new installations and is no longer available as a Feature on Demand, extending a phaseout that previously left the tool deprecated and then disabled by default. Microsoft emphasized that the change affects only the WMIC command-line utility, while the underlying WMI infrastructure remains supported.
The removal follows years of documented abuse of WMIC as a living-off-the-land binary listed by the LOLBAS project and widely used by malware and ransomware operators after compromise. Threat actors have used the tool to enumerate installed security products, delete Shadow Volume Copies, uninstall antivirus software, and add Microsoft Defender exclusions, making it useful for reconnaissance, defense evasion, and ransomware staging. Microsoft said PowerShell and other modern management tools are the intended replacements for legitimate administrative use.
Get the actors, campaigns, and ATT&CK mapping behind it.
11 events from the most recent confirmed update back to the earliest known activity.
Microsoft released KB5120998 to the Release Preview Channel for Windows 11 24H2 and 25H2, beginning rollout of Administrator protection. Microsoft said the feature hardens Windows against elevation-of-privilege attacks through just-in-time privileges and profile separation, though it is off by default and not considered a formal security boundary.
Beginning with the August 2026 Patch Tuesday update, Microsoft removed WMIC from Windows 11 versions 24H2 and 25H2 so it is no longer included or available as a Feature on Demand. Microsoft said the change affects only the WMIC utility and not the underlying WMI infrastructure.
In January 2024, Microsoft announced that WMIC would be removed altogether after first being disabled by default as part of its deprecation process.
Starting with Windows 11 version 22H2, Microsoft converted WMIC into a Feature on Demand rather than shipping it as a standard built-in component.
Microsoft deprecated WMIC in Windows 10 version 21H1 in 2021, extending its retirement beyond server platforms.
The LOLBAS project published an entry for WMIC, documenting it as a living-off-the-land binary that can be abused by attackers.
Microsoft deprecated the Windows Management Instrumentation Command-line utility (WMIC) in Windows Server 2012 in 2016, beginning its long-term phaseout.
In the September 2026 Update preview builds for Windows 11, also referred to as 26H2, WMIC was fully absent and could no longer be restored through Optional Features. Microsoft confirmed in updated release notes that the utility was removed in this release as part of its ongoing deprecation and removal process.
Microsoft also removed WMIC from Windows 11 beta builds released that week, extending the change to pre-release builds alongside supported releases.
Before full removal, Windows 11 version 25H2 disabled WMIC by default while still allowing it to be restored through optional features in earlier stages of the rollout.
In September, Microsoft announced that WMIC would be removed after upgrading to Windows 11 25H2 and later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
windowslatest.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcewindowslatest.com
Open sourcelearn.microsoft.com
Open sourcelolbas-project.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft's September 2026 Windows 11 update, `KB5124008`, fully removes the deprecated Windows Management Instrumentation Command-line utility (`WMIC`) and no longer provides it as a Feature on Demand. WMIC has been used legitimately for administrative automation, but ransomware and other malware have abused it to delete Volume Shadow Copies—undermining recovery—and weaken Microsoft Defender protections. Reported malware associated with WMIC techniques includes TeslaCrypt 4.1b, DeroHE, WannaCry, Serpent, WhiteRose, Zenis, and Saturn. Organizations using WMIC in applications, scripts, or operational workflows should migrate to supported Windows management alternatives and validate replacements before deployment. Microsoft offers a temporary downloadable WMIC package only for compatibility scenarios, but advises against restoring the utility broadly because retaining it preserves an attack surface frequently leveraged for defense evasion and ransomware recovery inhibition.
Sep 11, 2026
Researchers highlighted how Windows Management Instrumentation (**WMI**) can be abused to establish stealthy, fileless persistence on Windows systems and to support remote execution across an enterprise. Black Hat research detailed the use of permanent WMI event subscriptions, asynchronous event consumers, and WMI-based backdoors that can survive reboots while leaving limited traditional malware artifacts on disk. Follow-on research showed WMI remains relevant for lateral movement because it provides native access to remote process creation, system management, and execution through trusted Windows components. The combined findings reinforce that defenders should treat unusual WMI activity, remote WMI execution, and unauthorized event subscription creation as high-priority indicators of compromise in environments where attackers seek persistence and post-compromise mobility.
Aug 9, 2026
Trellix disclosed **PathWiper**, a destructive malware operation that abuses **DCOM** to move across Windows environments and trigger large-scale disk wiping. The activity was presented as a network erasure campaign rather than conventional ransomware, with the malware designed to render systems inoperable by corrupting or destroying data across affected hosts. The report highlights the use of legitimate Windows remote management mechanisms to propagate the wiper, underscoring how trusted administrative features can be turned into destructive tradecraft. For defenders, the findings point to the need for tighter controls on **DCOM** usage, stronger monitoring of lateral movement through native Windows components, and rapid containment of suspicious remote execution activity before wiping actions spread across the network.
Jul 12, 2026