Microsoft Removes WMIC LOLBin From Windows 11

Microsoft has removed wmic.exe from Windows 11 24H2 and 25H2, and from Windows 11 beta builds released this week, BleepingComputer reports. The Windows Management Instrumentation Command-line tool — a fixture on LOLBAS and an attacker standby for two decades — is now absent from shipping builds.

This was telegraphed. Microsoft deprecated WMIC in Windows 10, version 21H1 (May 2021). “Deprecated” meant: still ships, still works, removal coming. Five years later, the removal is here for Windows 11’s current supported versions.

Why WMIC stayed on defenders’ radar

WMIC maps to multiple MITRE ATT&CK techniques: T1047 (Windows Management Instrumentation) for system enumeration and remote execution, and T1546.003 (WMI Event Subscription) for fileless persistence. It’s been documented in commodity malware loaders, APT toolkits, and ransomware precursor activity alike. Because it’s a Microsoft-signed binary that ships with Windows, endpoint tools have historically had to tune carefully rather than block it outright.

The underlying WMI service isn’t going anywhere. PowerShell’s Get-CimInstance and Get-WmiObject cmdlets still work. What’s gone is the legacy command-line wrapper that scripts and attackers have called directly.

What this changes — split by OS version

Windows 11 24H2 and later: wmic.exe is absent. Any process tree showing wmic.exe on a 24H2+ host is either attacker-staged tooling or a manual restore. Treat it as a high-confidence indicator.

Windows 10 and Windows 11 pre-24H2: Nothing changes. WMIC is still present and still needs WMIC-aware detection logic. Enterprise environments won’t complete the transition to 24H2 for years — plan accordingly.

Action items — do these now

1. Audit automation that calls WMIC. Scripts, scheduled tasks, RMM agents, monitoring tools — anything shelling out to wmic.exe will break on 24H2+ endpoints. The replacement is PowerShell CIM: Get-CimInstance Win32_OperatingSystem instead of wmic os get, for example. Inventory this before your 24H2 rollout catches someone off-guard.

2. Split detection baselines by OS version. On 24H2+ systems, wmic.exe process execution is a near-certain anomaly — elevate the severity. On older endpoints, maintain your existing tiered WMIC detection logic. A flat global rule that ignores OS version will either drown older-host signals in false negatives or generate alert fatigue on newer hosts where WMIC shouldn’t exist.

3. Extend LOLBin coverage beyond WMIC now. Attackers will pivot. Alternatives already in documented use include PowerShell CIM sessions (New-CimSession), DCOM-based lateral movement, and WinRM scripting. If your hunting playbooks are WMIC-heavy, they need a complementary layer covering these paths. Get ahead of the rotation before adversary tooling catches up.

Priority call

If you’re rolling out Windows 11 24H2 or 25H2, fix your automation first and update detection baselines second — in that order. A broken RMM or monitoring script is a blind spot that compounds; WMIC detection gaps on hosts that don’t have the tool yet are future work.

For environments still running a mix of Windows 10 and Windows 11 23H2, this is a planning item rather than an emergency — but planning needs to happen now, before the 24H2 fleet is large enough that split detection logic becomes an afterthought. See August 2026 Patch Tuesday for context on where Microsoft’s Windows security posture is heading this cycle, and this month’s Defender update for the parallel thread on Windows endpoint security.

The removal is the right call. WMIC’s deprecation period ran five years — anyone still depending on it had ample warning. The relevant question now is how fast the enterprise endpoint population transitions and how quickly attackers rotate to alternatives.