Microsoft starts removing WMIC tool used by cybercriminals | SpinGraph: Safety framing
SpinGraph analysis of BleepingComputer's Microsoft starts removing WMIC tool used by cybercriminals story: safety framing, The Shield, Spin Score 65%, moderate…
Know the moment AI knows your story. Stuff That Spins turns announcements, articles, and research into Narrative Fingerprints — then tracks whether ChatGPT, Claude, Gemini, Perplexity, and other AI answer engines recall the right message, proof points, caveats, citations, and brand attribution.
Microsoft starts removing WMIC tool used by cybercriminals
WMIC, living-off-the-land, Windows 11 24H2, cybersecurity hardening
WMIC — a built-in Windows admin tool long exploited by attackers — is being deprecated and removed from Windows 11 24H2 and 25H2. Microsoft cites security hardening as the rationale, positioning the removal as proactive defense against living-off-the-land (LotL) attacks. The move follows years of documented misuse in ransomware, malware, and lateral movement campaigns, though no new vulnerabilities or breaches triggered the timing.
Emphasizes Microsoft’s reactive stewardship while minimizing discussion of trade-offs for legitimate administrators, lack of backward-compatibility mitigation, and absence of evidence that this specific removal materially disrupts real-world attack chains.
Microsoft removed the WMIC tool from Windows 11 to prevent cybercriminals from abusing it.
No mention of PowerShell’s broader capabilities and comparable abuse potential; No timeline for deprecation in Windows Server or LTSB editions; No reference to community or admin feedback on operational impact
The story redirects attention toward process, intent, scale, mission, or future benefits instead of unresolved concerns. Watch for loaded terms such as security hardening, abused by cybercriminals, proactive defense. The distribution reads as editorial reporting. A pressure point: No mention of PowerShell’s broader capabilities and comparable abuse potential.
Microsoft removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.
Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.
Extracted statistics from the source narrative
WMIC has been part of Windows since Windows XP; widely used by admins and attackers alike.