WMI is the Microsoft implementation of Web-Based Enterprise Management (WBEM)# and Common Information Model (CIM)#. It is particularly useful for retrieving and managing the Windows operating system’s information.
It can be accessed via PowerShell command Get-CimInstance or with open source GUI tool WMI Explorer.
There is an emerging form of malware in Windows that is fileless# known as Advanced Volatile Threats (AVTs). Such malware will operate in the volatile main memory which could avoid detection from anti-analysis techniques. Possible attack vectors including PowerShell, Windows Management Instrumentation (WMI)#, command prompt, .NET framework, and Remote Desktop Protocol (RDP). AVTs utilise scripts such as JavaScript and Visual Basic, and compile HTML files under the hood of a system process.