How many Living-off-the-Land Binaries abuse T1047?

LOLPulse tracks 3 verified living-off-the-land binaries across Windows, Linux, and macOS that adversaries can leverage to execute Windows Management Instrumentation (T1047).

How can detection engineers monitor for T1047?

Detection strategies involve correlating process command-line arguments, parent process lineage, and behavioral telemetry rules (KQL, Sigma, and Splunk) specifically authored for the binaries listed in this matrix.

T1047Tactic: ExecutionOfficial MITRE ATT&CK Page

T1047: Windows Management Instrumentation

Adversaries may abuse WMI or wmic.exe to execute malicious commands and query system information on local and remote systems.

Total Capable Binaries: 3

•

Windows: 3

•

Linux: 0

•

macOS: 0

Living-off-the-Land Matrix for T1047

Across 3 verified binaries

Windows1 payloads

wmic.exe

Windows Management Instrumentation Command-line (WMIC) provides a command-line interface for WMI. Abused for process execution, remote lateral movement, process creation, and running XSL stylesheets.

Sample Attack Vector:

wmic.exe process call create "powershell.exe -w hidden -enc ..."

Inspect wmic.exe & Telemetry

Windows1 payloads

Mofcomp.exe

Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts

Sample Attack Vector:

mofcomp.exe {PATH_ABSOLUTE:.mof}

Inspect Mofcomp.exe & Telemetry

Windows1 payloads

wbemtest.exe

WMI/WBEM Test Binary

Sample Attack Vector:

wbemtest.exe

Inspect wbemtest.exe & Telemetry

Curated & Verified by

Sharon Ben Moshe

Cybersecurity Researcher & Detection Engineer • Check Point

LinkedIn Profile Methodology & Papers