Windows 10: Details about wmic and wmi

Hello everyone,I have been working and researching about wmi and wmic, and I have come to the conclusion that wmic can be abused by attackers if the system gets compromised and it should not be available to the local users but to admins. I want to know if we block the access of wmic to local users will it affect the working of wmi utilities which are updating of windows and other tasks? Keep in mind that Microsoft has given the recommendation of block rules which also include this file wmic.exe.link of the MS recommendation:https://learn.microsoft.com/en-us/windows/security/threat-protection

:)

 

Memory allocation error in WMI tool WMIC ?

There is no bug report in Microsoft, so I hope they scan security topics from time to time.

WMI and WMIC tool are things that should not fail. But WMIC fails when given incorrect input string with very bad looking error. I wonder, can it be exploited or not, anyway. If someone finds it interesting

Code:

C:\Windows\system32>wmic format:table memorychip get

Failed to allocate Memory!!!

format:table here is used wrong, well, I just forgot the correct syntax.

But see, "format:" keyword is not ignored as a garbage, and parsed as some keyword, causing some very incorrect reaction.

 

WMI report inconsistent

[running Windows 10 Creators]

Hi,

While investigating the "Error while updating ESET NOD32 Antivirus status to SECURITY_PRODUCT_STATE_ON." problem, I discovered something rather strange...

If I go to Security and Maintenance, the system reports that ESET NOD32 is turned on. However, if I use WMIC to list the installed security products this way :

wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get * /value

the result is : No Instance(s) available.

This is inconsistent. Or Windows doesn't use WMI in the Security Center to retrieve the installed antivirus apps. Did I miss something ?

 

Is WMIC available in the Win 10 installation environment?

https://docs.microsoft.com/en-us/win...32/wmisdk/wmic

Important: The WMI command-line (WMIC) utility is deprecated as of Windows 10, version 21H1, and as of the 21H1 semi-annual channel release of Windows Server.
This utility is superseded by Windows PowerShell for WMI (see Chapter 7—Working with WMI). This deprecation applies only to the WMI command-line (WMIC) utility; Windows Management Instrumentation (WMI) itself is not affected. Also see Windows 10 features we're no longer developing.