diff --git a/atomics/T1047/T1047.md b/atomics/T1047/T1047.md
index c6f5856d..c6b6375f 100644
--- a/atomics/T1047/T1047.md
+++ b/atomics/T1047/T1047.md
@@ -14,6 +14,10 @@ An adversary can use WMI to interact with local and remote systems and use it as
- [Atomic Test #4 - WMI Reconnaissance List Remote Services](#atomic-test-4---wmi-reconnaissance-list-remote-services)
+- [Atomic Test #5 - WMI Execute Local Process](#atomic-test-5---wmi-execute-local-process)
+
+- [Atomic Test #6 - WMI Execute Remote Process](#atomic-test-6---wmi-execute-remote-process)
+
@@ -84,4 +88,47 @@ wmic /node:"#{node}" service where (caption like "%#{service_search_string} (%")
+
+
+
+## Atomic Test #5 - WMI Execute Local Process
+This test uses wmic.exe to execute a process on the local host.
+
+**Supported Platforms:** Windows
+
+
+#### Inputs
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| process_to_execute | Name or path of process to execute. | String | calc.exe|
+
+#### Run it with `command_prompt`!
+```
+wmic process call create #{process_to_execute}
+```
+
+
+
+
+
+
+## Atomic Test #6 - WMI Execute Remote Process
+This test uses wmic.exe to execute a process on a remote host.
+
+**Supported Platforms:** Windows
+
+
+#### Inputs
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| node | Ip Address | String | 192.168.0.1|
+| process_to_execute | Name or path of process to execute. | String | calc.exe|
+
+#### Run it with `command_prompt`!
+```
+wmic /node:"#{node}" process call create #{process_to_execute}
+```
+
+
+
diff --git a/atomics/T1047/T1047.yaml b/atomics/T1047/T1047.yaml
index 2168a481..af638ac5 100644
--- a/atomics/T1047/T1047.yaml
+++ b/atomics/T1047/T1047.yaml
@@ -54,3 +54,40 @@ atomic_tests:
command: |
wmic /node:"#{node}" service where (caption like "%#{service_search_string} (%")
+- name: WMI Execute Local Process
+ description: |
+ This test uses wmic.exe to execute a process on the local host.
+
+ supported_platforms:
+ - windows
+ input_arguments:
+ process_to_execute:
+ description: Name or path of process to execute.
+ type: String
+ default: calc.exe
+ executor:
+ name: command_prompt
+ elevation_required: false
+ command: |
+ wmic process call create #{process_to_execute}
+
+- name: WMI Execute Remote Process
+ description: |
+ This test uses wmic.exe to execute a process on a remote host.
+
+ supported_platforms:
+ - windows
+ input_arguments:
+ node:
+ description: Ip Address
+ type: String
+ default: 192.168.0.1
+ process_to_execute:
+ description: Name or path of process to execute.
+ type: String
+ default: calc.exe
+ executor:
+ name: command_prompt
+ elevation_required: false
+ command: |
+ wmic /node:"#{node}" process call create #{process_to_execute}
diff --git a/atomics/index.md b/atomics/index.md
index 769a9745..9699e862 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -781,6 +781,8 @@
- Atomic Test #2: WMI Reconnaissance Processes [windows]
- Atomic Test #3: WMI Reconnaissance Software [windows]
- Atomic Test #4: WMI Reconnaissance List Remote Services [windows]
+ - Atomic Test #5: WMI Execute Local Process [windows]
+ - Atomic Test #6: WMI Execute Remote Process [windows]
- [T1028 Windows Remote Management](./T1028/T1028.md)
- Atomic Test #1: Enable Windows Remote Management [windows]
- Atomic Test #2: PowerShell Lateral Movement [windows]
diff --git a/atomics/index.yaml b/atomics/index.yaml
index e4e73406..121011b3 100644
--- a/atomics/index.yaml
+++ b/atomics/index.yaml
@@ -22558,6 +22558,44 @@ execution:
command: 'wmic /node:"#{node}" service where (caption like "%#{service_search_string}
(%")
+'
+ - name: WMI Execute Local Process
+ description: 'This test uses wmic.exe to execute a process on the local host.
+
+'
+ supported_platforms:
+ - windows
+ input_arguments:
+ process_to_execute:
+ description: Name or path of process to execute.
+ type: String
+ default: calc.exe
+ executor:
+ name: command_prompt
+ elevation_required: false
+ command: 'wmic process call create #{process_to_execute}
+
+'
+ - name: WMI Execute Remote Process
+ description: 'This test uses wmic.exe to execute a process on a remote host.
+
+'
+ supported_platforms:
+ - windows
+ input_arguments:
+ node:
+ description: Ip Address
+ type: String
+ default: 192.168.0.1
+ process_to_execute:
+ description: Name or path of process to execute.
+ type: String
+ default: calc.exe
+ executor:
+ name: command_prompt
+ elevation_required: false
+ command: 'wmic /node:"#{node}" process call create #{process_to_execute}
+
'
T1028:
technique:
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index 126d2809..3d408064 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -648,6 +648,8 @@
- Atomic Test #2: WMI Reconnaissance Processes [windows]
- Atomic Test #3: WMI Reconnaissance Software [windows]
- Atomic Test #4: WMI Reconnaissance List Remote Services [windows]
+ - Atomic Test #5: WMI Execute Local Process [windows]
+ - Atomic Test #6: WMI Execute Remote Process [windows]
- [T1028 Windows Remote Management](./T1028/T1028.md)
- Atomic Test #1: Enable Windows Remote Management [windows]
- Atomic Test #2: PowerShell Lateral Movement [windows]