Common Information Model (CIM)/WMI
We already learned in Chapter 3, Exploring PowerShell Remote Management Technologies and PowerShell Remoting, that WMI is Microsoft’s implementation of the CIM, and how to use WMI- or CIM-related PowerShell cmdlets.
In this chapter, we are exploring WMI a little bit further in the system context.
WMI is not a new technology, and WMI attacks are not a new attack vector. WMI only produces a small forensic footprint, runs in memory only, and is a great way to evade whitelisting as well as host-based security tools. Therefore, WMI has been weaponized in attacks in recent years like never before.
In general, applications such as PowerShell, .NET, C/C++, VBScript, and many more can access WMI through the WMI API. The CIM Object Manager (CIMOM) then manages the access between each WMI component. The communication relies on COM/DCOM.
The following figure demonstrates the architecture of WMI:
Figure 5.25 –...
