SharpWMI
SharpWMI is a WMI-based post-compromise utility used for remote execution, reconnaissance, lateral movement, and proliferation on Windows systems via WMI and DCOM. The content states it can execute WMI queries on remote hosts and enable arbitrary command or code execution. Cisco Talos observed SharpWMI used by multiple China-linked intrusion clusters, including UAT-7237 and UAT-8837. In UAT-7237 intrusions targeting web infrastructure entities and a web hosting provider in Taiwan, SharpWMI was used alongside WMICmd during reconnaissance and remote execution after initial access via exploitation of known vulnerabilities on internet-exposed servers. In UAT-8837 activity targeting critical infrastructure in North America since at least 2025, SharpWMI was part of a rotating set of open-source and living-off-the-land remote-execution tools used when other tooling was blocked; Talos specifically noted the actor attempted to download and execute SharpWMI but it was detected by Cisco Secure Endpoint. Mentioned related infrastructure and activity include attacker-hosted tooling downloads from 141[.]164[.]50[.]141 and associated URLs under http[://]141[.]164[.]50[.]141/sdksdk608/, though the content does not attribute those IOCs exclusively to SharpWMI.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Impacket, Invoke-WMIExec, GoExec, SharpWMI – Execute commands on remote systems via WMI and DCOM; the actor cycles through the tools when detection blocks execution
Techniques & procedures
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A WMI-based remote execution tool used to run commands on remote Windows hosts.
C#/.NET WMI-focused post-exploitation tool used for remote command execution and lateral movement via WMI.
Tool used to run WMI queries and execute commands remotely for reconnaissance and lateral movement/proliferation.
WMI-based utility used for reconnaissance and lateral movement via Windows Management Instrumentation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.