WMI Spawning RMM Tool (T1105)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•1•0•3

Detects lateral movement or persistence where WMI directly spawns an RMM tool like ScreenConnect, AnyDesk, or other common remote management tools. This activity is often indicative of an attacker establishing remote access or maintaining persistence on a compromised system.