← All Lessons
Premium
TechniqueActive Directory
WMI for Execution and Lateral Movement
WMI is a built-in Windows management interface that an attacker with administrative credentials can abuse to run commands on remote hosts without dropping a tool or opening an interactive session. This lesson explains why the technique works, what an operator gains, and how to communicate the risk in interviews, reports, and stakeholder conversations.
Sign in or upgrade to unlock the full premium library.
What you'll learn
- Windows Management Instrumentation (WMI)
- Win32_Process Create
- DCOM transport
- Administrative requirement
- Blind execution
- Living off the land
What premium includes
- All 68 lessons: AD techniques, professional skills, each with interview answers and study kits
- Complete study kit for every lesson: quizzes, flashcards, and briefs
- Every learning track with full structured progression
- All 12 attack paths: full compromise walkthroughs for interviews and reports
- New lessons and attack paths added regularly
