WMIC lateral test

wmic /node:<target> process call create cmd

Executes a remote process with WMIC against the test host, validating detection of WMI lateral movement.

Run it in the purple team lab when you want to validate detection of WMI lateral movement: wmic /node process call create executes the process on the target (the lateral movement method without creating services) and the team checks what was detected — Event 4688 (the process on the target), 4624, Sysmon Event 1 (wmic), SIEM rules, EDR. It's the validation of WMI lateral movement: the alternative to PsExec that leaves no service. In purple teaming, WMIC validates detection of WMI remote execution — the pattern actors use to move without PsExec artifacts.

Do not run it outside the lab: WMI executes the process on the target (real change) — the test host is the place. And note: detection of WMI movement is harder than PsExec (no new service): the layers validated are the remote process (4688 with wmiprvse as parent), the logon, and the context — validation measures those layers. wmic.exe is deprecated in Windows 11 (replaced by PowerShell CIM): validation with wmic covers legacy environments; the modern variant (Invoke-CimMethod) is validated separately. Cleanup (created processes) upon completion.