Microsoft Removes WMIC From Windows 11 24H2, 25H2, and Beta Builds
Summary
Microsoft removed the legacy WMIC command-line tool from Windows 11 24H2, 25H2, and recent beta builds. The change follows its deprecation plan; WMI remains available, with Microsoft recommending PowerShell and other alternatives.
Key points
- WMIC has been removed from Windows 11 24H2 and 25H2 and is no longer available as a Feature on Demand in new installations.
- The removal is part of Microsoft's ongoing WMIC deprecation plan; WMI itself is unaffected.
- Threat actors have abused WMIC as a living-off-the-land tool, including to delete Shadow Volume Copies and inspect installed security software.
- The article says malware has also used WMIC to add Microsoft Defender exclusions.
- Microsoft recommends PowerShell, WMI's COM API, .NET libraries, or scripting languages for tasks previously performed with WMIC.
Article Details
- Event Type
- Microsoft's removal of the legacy WMIC command-line utility from Windows 11 24H2, 25H2, and recent beta builds
- Impact
- The change is intended to reduce abuse of WMIC as a living-off-the-land binary, including use to delete Shadow Volume Copies, discover security software, uninstall security products, and add Microsoft Defender exclusions. Windows Management Instrumentation (WMI) itself remains unaffected.
MITRE ATT&CK
T1490 · Inhibit System RecoveryRansomware encryptors have used WMIC commands to delete Shadow Volume Copies and hinder recovery.T1518.001 · Security Software DiscoveryThreat actors have used WMIC to query for installed security solutions and antivirus software.T1562.001 · Disable or Modify ToolsMalware has been observed using WMIC to add Microsoft Defender exclusions to evade detection.
Vendors
Products
Microsoft Defender Antimalware Platformlong abused for actions like deleting Shadow Volume Copies, checking security software, and adding Microsoft Defender exclusions.Windows 11Microsoft has removed the legacy Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2, 25H2, and new beta builds as part of its broader deprecation plan.Windows Management Instrumentation (WMI)WMIC is a legacy built-in Windows command-line utility that helps interact with the Windows Management Instrumentation (WMI) system using text commands.