Microsoft Removes WMIC Tool Exploited by Cybercriminals
TL;DR. Microsoft has removed the legacy WMIC tool from Windows 11 24H2 and 25H2, aiming to improve operating system security. - The Windows Management Instrumentation Command-line (WMIC) tool was deprecated years ago and served as a 'living-off-the-land' binary for threat actors. - Its removal targets a wide range of malware and attack tactics that previously relied on the built-in Windows utility. - IT administrators are advised to transition to PowerShell or other modern WMI tools for managing Windows systems.
- Microsoft removed the WMIC tool from Windows 11 24H2 and 25H2 builds.
- WMIC was a legacy command-line utility used by cybercriminals as a 'LOLBIN'.
- The removal aims to enhance Windows security by thwarting common malware tactics.
- IT administrators should use modern alternatives like PowerShell for WMI tasks.
Sources
- Microsoft starts removing WMIC tool used by cybercriminals — bleepingcomputer.com