---
id: 9494
title: "More Fun With WMI"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2025/09/18/more-fun-with-wmi/"
published_at: "2025-09-18T16:02:18Z"
phying_url: "https://phying.com/item/9494"
lang: en
---

# More Fun With WMI

## Summary

TL;DR: Win32_Process has long been the go-to WMI class for remote command execution. In this post we cover MSFT_MTProcess — a newer WMI class that functions like Win32_Process but also offers additional capabilities, including remote process creation and process-dumping on Windows Server 2016 and newer (and on workstations if the provider is installed). From time to time, across different versions […]

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2025-09-18T16:02:18Z
- **Original:** https://specterops.io/blog/2025/09/18/more-fun-with-wmi/
- **Phying News:** https://phying.com/item/9494