WMIC.exe, WMI’s command-line utility, has been seen on countless occasions being abused by attackers to acquire system level information or execute privileged actions on the local host it’s running on or on remote hosts. When WMIC performs actions on remote hosts, the remote host will show a corresponding process launch of WmiPrvSE.exe to handle the source host’s WMIC requests. As such, WmiPrvSE.exe can be seen in the process tree of reconnaissance and lateral movement actions, sometimes launching a shell and other times executing desired attacker commands directly (e.g. net.exe, netstat, ping, etc.).