14.B) Windows Management Instrumentation, Remote File Copy, Credential Dumping, Obfuscated Files or Information, Process Discovery, Deobfuscate/Decode Files or Information

[Cyb3rWard0g]

Description

The attacker then uses the new elevated access to create and execute code within a custom WMI class (T1047) that downloads (T1105) and executes Mimikatz to dump plain-text credentials (T1003), which are parsed, encoded, and stored in the WMI class (T1027). After tracking that the WMI execution has completed (T1057), the attacker reads the plaintext credentials stored within the WMI class (T1140)