---
id: 8167
title: "Getting Started with WMI Weaponization – Part 6"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/adversary-simulation/getting-started-wmi-weaponization-part-6/"
published_at: "2017-04-20T00:00:00Z"
tags: ["powershell", "wmi", "defense-evasion", "persistence", "covert-storage"]
phying_url: "https://phying.com/item/8167"
lang: en
---

# Getting Started with WMI Weaponization – Part 6

## Summary

Introduces Invoke-WMIFS, a PowerShell module that abuses a custom WMI class to stash files as Base64 chunks inside the CIM repository, a quota-aware covert storage trick for evasive operations.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2017-04-20T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/adversary-simulation/getting-started-wmi-weaponization-part-6/
- **Phying News:** https://phying.com/item/8167