WMI

WMI is the Windows framework for querying system information and managing computers locally or remotely, used heavily by administrators and monitoring tools. Attackers love it for the same reasons: it can execute commands on remote hosts for lateral movement and create event subscriptions for stealthy persistence, all using a trusted built-in component. Because it is a classic living-off-the-land technique, defenders monitor WMI activity closely.