Mofcomp.exe
Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts
Full path
C:\Windows\System32\wbem\mofcomp.exe
C:\Windows\SysWOW64\wbem\mofcomp.exeCommands
Threat actors can use mofcomp.exe to register a malicious MOF file as a new class in the WMI repository
mofcomp.exe {PATH_ABSOLUTE:.mof}Abuse of mofcomp.exe to parse a file which contains MOF statements in order create new classes as part of the WMI repository
os: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11, Windows Server 2008+
Detection
- IOCstrange parent processes spawning mofcomp.exe like cmd.exe or powershell.exe
- Sigma https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
Resources
- https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
- https://docs.microsoft.com/en-us/windows/win32/wmisdk/managed-object-format--mof-
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
- https://medium.com/threatpunter/detecting-removing-wmi-persistence-60ccbb7dff96
acknowledgement: Daniel Gott @gott_cyber, The DFIR Report @TheDFIRReport, Nasreddine Bencherchali @nas_bench