Windows Management Instrumentation (WMI) is a built-in Windows framework for system inventory, configuration, and remote administration. It exposes operating system data and controls through a structured interface that scripts, management tools, and enterprise software can query. Administrators use it to collect hardware details, manage services, launch processes, and automate routine tasks across many endpoints.
WMI matters in cyber security because it is both powerful and trusted. Attackers often abuse it for “living off the land” activity: remote command execution, host discovery, lateral movement, and persistence through event subscriptions. Because WMI is legitimate Windows functionality, malicious use can blend in with normal administration. Defenders monitor WMI-related events, restrict remote WMI access, and look for unusual query patterns or process creation tied to WMI activity. Understanding WMI helps teams separate routine management from stealthy attacker behavior.