Heads up — wmic is deprecated. Microsoft is removing it from current Windows; it may be absent or disabled on newer builds. Every command here lists its PowerShell replacement (Get-CimInstance / Get-WmiObject) — prefer those going forward. wmic itself is a signed LOLBIN, so also watch for attackers using it (especially process call create and /node: remote execution).
Triage
Processes & ancestry
wmic's best trick: the parent PID, path, and command line that tasklist can't show.
wmic process get Name,ProcessId,ParentProcessId,ExecutablePathThe triage staple — name, PID, parent PID, and full path in one table. PS: Get-CimInstance Win32_Process | Select Name,ProcessId,ParentProcessId,Pathwmic process get Name,ProcessId,CommandLineFull command lines — where encoded PowerShell and LOLBin args hide. PS: Get-CimInstance Win32_Process | Select Name,ProcessId,CommandLinewmic process where "name='svchost.exe'" get ProcessId,ParentProcessId,CommandLineFilter to one image and check every parent — a svchost not from services.exe stands out. PS: Get-CimInstance Win32_Process -Filter "name='svchost.exe'"wmic process where "processid=4812" get ParentProcessId,ExecutablePath,CommandLineResolve one PID to its parent, path, and command line. PS: Get-CimInstance Win32_Process -Filter "ProcessId=4812"wmic process where "name='powershell.exe'" get CommandLineEvery PowerShell command line running now. PS: Get-CimInstance Win32_Process -Filter "name='powershell.exe'" | Select CommandLinewmic process call create "…"Launches a new process via WMI — a known execution / lateral-movement technique. Legit for admins, high-signal from an odd parent. PS: Invoke-CimMethod Win32_Process -MethodName Createwmic process where "processid=4812" deleteKill a process by PID. PS: Stop-Process -Id 4812 -ForceTriage
Services
wmic service get Name,DisplayName,PathName,StartMode,StateEvery service with its binary path and start mode. Unquoted paths and binaries in user-writable folders are the flags. PS: Get-CimInstance Win32_Service | Select Name,PathName,StartMode,Statewmic service where "state='Running'" get Name,PathNameJust the running services and their paths. PS: Get-CimInstance Win32_Service -Filter "state='Running'"wmic service where "startmode='Auto'" get Name,PathName,StateAuto-start services — persistence lives here. PS: Get-CimInstance Win32_Service -Filter "startmode='Auto'"wmic service get Name,StartNameThe account each service runs as — a service running as a user account is worth noting. PS: Get-CimInstance Win32_Service | Select Name,StartNamePersistence
Startup & scheduled
wmic startup get Caption,Command,LocationAutostart entries (Run keys and Startup folder) in one list — a top persistence check. PS: Get-CimInstance Win32_StartupCommand | Select Caption,Command,Locationwmic startup list fullThe same with every field. PS: Get-CimInstance Win32_StartupCommand | Format-List *wmic ntdomain get DomainName,DomainControllerNameDomain and DC the host trusts. PS: Get-CimInstance Win32_NTDomainRecon
System & disk
wmic computersystem get Name,Domain,Manufacturer,Model,UserNameHost name, domain, hardware, and the logged-on user — fast orientation. PS: Get-CimInstance Win32_ComputerSystemwmic os get Caption,Version,BuildNumber,OSArchitecture,LastBootUpTimeOS version, build, and last boot. PS: Get-CimInstance Win32_OperatingSystemwmic logicaldisk get DeviceID,DriveType,FreeSpace,SizeDrives and free space — spot extra volumes or a nearly-full disk. PS: Get-CimInstance Win32_LogicalDiskwmic nicconfig where "ipenabled=true" get Description,IPAddress,MACAddress,DefaultIPGatewayIP, MAC, and gateway per active adapter. PS: Get-CimInstance Win32_NetworkAdapterConfiguration -Filter "ipenabled=true"wmic bios get SerialNumber,SMBIOSBIOSVersionSerial and BIOS — asset identification. PS: Get-CimInstance Win32_BIOSRecon
Patches & software
wmic qfe get HotFixID,InstalledOn,DescriptionInstalled patches (hotfixes) — check whether a host is missing a key fix. PS: Get-CimInstance Win32_QuickFixEngineering or Get-HotFixwmic product get Name,Version,VendorInstalled MSI software inventory. Slow, and it can trigger reconfigure events — prefer the registry or PowerShell. PS: Get-CimInstance Win32_Product (same caveat)wmic path win32_pnpentity get Name,DeviceIDConnected devices — USB and removable media hunting. PS: Get-CimInstance Win32_PnPEntityIdentity
Accounts & shares
wmic useraccount get Name,SID,Disabled,LocalAccountLocal and cached accounts with SID and enabled state. PS: Get-CimInstance Win32_UserAccountwmic group get Name,SIDGroups on the host. PS: Get-CimInstance Win32_Groupwmic share get Name,Path,DescriptionShares this host offers, including admin shares — an exfil staging check. PS: Get-CimInstance Win32_Sharewmic sysaccount get Name,SIDBuilt-in system accounts and their SIDs. PS: Get-CimInstance Win32_SystemAccountFleet
Remote & formatting
wmic /node:SRV01 process get Name,ProcessId,CommandLineRun any query against a remote host (needs rights + DCOM/RPC). PS: Get-CimInstance -ComputerName SRV01 Win32_Processwmic /node:SRV01 process call create "…"Remote execution over WMI — a classic lateral-movement move. Legit for admins; high-signal otherwise. PS: Invoke-CimMethod -ComputerName SRV01 …wmic /node:@hosts.txt os get Caption,VersionQuery a list of hosts from a file at once. PS: Get-CimInstance -ComputerName (gc hosts.txt) Win32_OperatingSystemwmic process get Name,ProcessId /format:csvCSV output for a ticket or a diff. /format:list and /format:htable too. PS: … | Export-Csv -NoTypeInformationwmic /output:C:\procs.txt process list briefWrite results to a file directly. PS: … | Out-File C:\procs.txtThe move: use wmic for a quick parent-PID / command-line read when PowerShell isn't handy, but write new tooling with Get-CimInstance — and treat wmic process call create and /node: in your logs as execution to investigate, not just admin noise.