Microsoft Removes WMIC Tool Used by Cybercriminals

WMIC's Legacy and Removal Timeline

Microsoft deprecated WMIC in Windows Server 2012 (in 2016) and Windows 10 21H1 (in 2021), and it converted it into a Feature on Demand (FoD) starting with Windows 11 22H2 (in 2022), and announced in January 2024 that it would be removed altogether after first disabling it by default.

WMIC's Role in Malware and Attack Tactics

WMIC has long been considered a LOLBIN (living-off-the-land binary), a built-in Microsoft-signed executable that threat actors have abused for a wide range of malicious activities during attacks targeting Windows devices. For instance, ransomware encryptors commonly use the WMIC command to delete Shadow Volume Copies to ensure that the victims can't recover encrypted data. Other threat actors have also used WMIC to query for the list of installed security solutions and antivirus software and uninstall them. Malware has also been observed using WMIC to add exclusions to Microsoft Defender, which helps evade detection on compromised systems.

Impact of WMIC's Removal

The removal of WMIC tool is expected to improve the overall security of Windows 11 by thwarting a wide range of malware and attack tactics. This move is part of a process announced in September, when the company said that WMIC will be removed after upgrading to Windows 11 25H2 and later. Further guidance for IT administrators who use WMIC is available in this support document, which recommends using PowerShell and other modern tools (e.g., WMI's COM API, .NET libraries, or scripting languages) for tasks previously done with WMIC.