How to find and remove WMI Persistence malware from Windows PCs

Microsoft created Windows Management Instrumentation (WMI) to handle how Windows computers allocate resources in the operating environment. WMI does another important thing: It facilitates local and remote access to computer networks.

Unfortunately, black hat hackers can hijack this capability for malicious purposes through a persistent attack. So here's how to remove WMI Persistence malware from Windows and keep yourself safe.

What is WMI Persistence and why is it dangerous?

WMI Persistence refers to the attacker installing a script, specifically an event handler, that is always fired when a WMI event occurs. For example, this will happen when the system boots or the system administrator does something on the PC, such as opening a folder or using a program.

Attacks are dangerous because they happen stealthily. As explained on Microsoft Scripting, the attacker creates a permanent WMI event subscription to execute the payload that acts as a system process and cleans up its execution log. With this attack vector, an attacker can avoid detection through command line inspection.

How to prevent and remove WMI Persistence

WMI event subscriptions are cleverly created to avoid detection. The best way to avoid these attacks is to disable the WMI service. Doing this will not affect your overall user experience unless you are an advanced user.

The next best option is to block WMI protocol ports by configuring DCOM to use a single static port and block that port. You can check out TipsMake's guide on how to close vulnerable ports for more instructions on how to do this.

This measure allows the WMI service to run locally while blocking remote access. This is a good idea, especially since accessing a remote computer comes with its own risks.

Finally, you can configure WMI to scan and warn you for threats, as Chad Tilbury demonstrated in this presentation:

Power should not be in the wrong hands

WMI is a powerful system manager and risks becoming a dangerous tool in the wrong hands. Worse still, to carry out this attack, not much advanced technical knowledge is required. Instructions on how to create and launch WMI Persistence attacks are freely available on the internet.

So any bad guy can spy on you remotely or steal data without leaving a trace. However, the good news is that there are no absolutes in technology and cybersecurity. It is still possible to prevent and eliminate the existence of WMI before an attacker causes major damage.

Jessica Tanner

Update 17 February 2023