Microsoft removes WMIC tool abused by cybercriminals
▼ Summary
– Microsoft removed WMIC from Windows 11 24H2 and 25H2, plus recent beta builds, as part of its ongoing deprecation process announced in September.
– WMIC is a legacy command-line tool for interacting with Windows Management Instrumentation (WMI), which itself remains unaffected by this change.
– WMIC was previously deprecated in Windows Server 2012 and Windows 10 21H1, became a Feature on Demand in 2022, and is now unavailable as an FoD in new installations.
– Microsoft recommends IT administrators use PowerShell, WMI’s COM API, .NET libraries, or scripting languages as replacements for WMIC.
– The removal aims to improve security by blocking malware abuse, as threat actors used WMIC for actions like deleting Shadow Volume Copies, uninstalling security tools, and adding Defender exclusions.
Microsoft has officially stripped the WMIC tool from its latest Windows 11 releases, marking the end of a long-deprecated command-line utility that had become a favorite among cybercriminals. The company confirmed the removal in Windows 11 versions 24H2 and 25H2, as well as in the beta builds shipped this week.
The Windows Management Instrumentation Command-line (WMIC) utility has been a staple for system administrators, allowing them to interact with the WMI framework through text-based commands. Its retirement, however, is no surprise. Microsoft first signaled this move back in September, stating that WMIC would disappear following the upgrade to Windows 11 25H2 and subsequent versions.
The deprecation timeline stretches back years. WMIC was officially marked as deprecated in Windows Server 2012 back in 2016, and again in Windows 10 21H1 in 2021. With the arrival of Windows 11 22H2 in 2022, Microsoft converted it into a Feature on Demand (FoD), and by January 2024, the company announced plans to disable it by default before removing it entirely.
“Windows Management Instrumentation Command-line (WMIC) has been removed in this release. This change is part of the ongoing deprecation and removal of WMIC from Windows,” Microsoft noted on Monday. Just three days earlier, the company also revealed that the tool is “already removed by default in new installations of Windows 11, versions 24H2 and 25H2, and is no longer available as a Feature on Demand (FoD).”
It is crucial to clarify that these changes target only the legacy WMIC component. The underlying Windows Management Instrumentation (WMI) system itself remains fully functional and untouched. For IT professionals who have relied on WMIC, Microsoft has published a support document recommending alternatives such as PowerShell, the WMI COM API, . NET libraries, or other scripting languages to handle tasks previously performed with WMIC.
The driving force behind this removal is security. WMIC has long been classified as a LOLBIN, or living-off-the-land binary, meaning it is a legitimate, Microsoft-signed executable that attackers frequently weaponize during intrusions. Its abuse has been widespread. Ransomware operators, for instance, commonly leverage WMIC to delete Shadow Volume Copies, effectively blocking victims from restoring encrypted files. Other malicious actors have used the tool to enumerate installed security software and antivirus products, then silently uninstall them. There have also been documented cases of malware employing WMIC to inject exclusions into Microsoft Defender, a tactic that allows infections to persist undetected on compromised machines.
By eliminating WMIC, Microsoft is closing a significant attack surface. While the transition may require some adjustment for legacy-minded administrators, the security payoff is substantial, as a wide array of known attack techniques will no longer function on updated systems.
(Source: BleepingComputer)
