Getting Started with WMI Weaponization – Part 5

Introduces Invoke-WMIFS, a PowerShell module that abuses a custom WMI class to stash files as Base64 chunks inside the CIM repository, a quota-aware covert storage trick for evasive operations.

Teaches enumerating the 1,500-plus WMI classes on a system with Get-CimClass, then dissecting properties and methods of classes like Win32_Process to find attacker-useful functionality.

Shows how stolen Exchange credentials can be weaponized through malicious Outlook rules that sync via Exchange and trigger a Start Application action, executing payloads without workstation access.

With the extensions/write permission, an attacker can deploy the Salt Minion extension pointed at a rogue Salt Master and push arbitrary states to an Azure VM as root over ZeroMQ ports 4505/4506.

With extensions/write, an attacker can point the Chef extension at a rogue Chef server for stealthy command execution and persistence on Azure VMs disguised as routine configuration management.

NetSPI discovered Nested App Authentication (BroCI) flows that bypass Entra Conditional Access policies to mint Graph API tokens, mainly a post-phishing persistence vector; Microsoft has fixed it.