Microsoft starts removing WMIC tool used by cybercriminals | SpinGraph: Safety framing
description: SpinGraph analysis of BleepingComputer's Microsoft starts removing WMIC tool used by cybercriminals story: safety framing, The Shield, Spin Score 65%, moderate…
canonical: https://stuffthatspins.com/spin/microsoft-starts-removing-wmic-tool-used-by-cybercriminals
markdown: https://stuffthatspins.com/spin/microsoft-starts-removing-wmic-tool-used-by-cybercriminals.md
keywords: WMIC
keywords: living-off-the-land
keywords: Windows 11 24H2
keywords: The Shield
keywords: narrative intelligence
published: 2026-08-18T08:12:08+00:00
modified: 2026-08-18T14:25:32.887066+00:00

Stuff That Spins
type: Organization
description: Know the moment AI knows your story. Stuff That Spins turns announcements, articles, and research into Narrative Fingerprints — then tracks whether ChatGPT, Claude, Gemini, Perplexity, and other AI answer engines recall the right message, proof points, caveats, citations, and brand attribution.

Microsoft starts removing WMIC tool used by cybercriminals
type: NewsArticle
alternative headline: Microsoft starts removing WMIC tool used by cybercriminals | SpinGraph: Safety framing
description: SpinGraph analysis of BleepingComputer's Microsoft starts removing WMIC tool used by cybercriminals story: safety framing, The Shield, Spin Score 65%, moderate…
date published: 2026-08-18T08:12:08+00:00
date modified: 2026-08-18T14:25:32.887066+00:00
main entity of page: https://stuffthatspins.com/spin/microsoft-starts-removing-wmic-tool-used-by-cybercriminals
is accessible for free: true
language: en-US
article section: cybersecurity
keywords: WMIC, living-off-the-land, Windows 11 24H2, cybersecurity hardening
author: BleepingComputer
publisher: Stuff That Spins
citation: https://www.bleepingcomputer.com/news/microsoft/microsoft-removes-wmic-lolbin-tool-in-windows-11-beta-builds/
about: WMIC
about: living-off-the-land
about: Windows 11 24H2
about: cybersecurity hardening
mentions: BleepingComputer
abstract: WMIC — a built-in Windows admin tool long exploited by attackers — is being deprecated and removed from Windows 11 24H2 and 25H2. Microsoft cites security hardening as the rationale, positioning the removal as proactive defense against living-off-the-land (LotL) attacks. The move follows years of documented misuse in ransomware, malware, and lateral movement campaigns, though no new vulnerabilities or breaches triggered the timing.

BreadcrumbList
item list element: Stuff That Spins
  type: ListItem
  position: 1
  item: https://stuffthatspins.com/
item list element: Microsoft starts removing WMIC tool used by cybercriminals
  type: ListItem
  position: 2
  item: https://stuffthatspins.com/spin/microsoft-starts-removing-wmic-tool-used-by-cybercriminals

Spin Analysis: safety framing
type: AnalysisNewsArticle
description: Emphasizes Microsoft’s reactive stewardship while minimizing discussion of trade-offs for legitimate administrators, lack of backward-compatibility mitigation, and absence of evidence that this specific removal materially disrupts real-world attack chains.
about: safety framing
  type: DefinedTerm
  description: Security-first platform steward
  term code: The Shield
additional property: Spin Score
  type: PropertyValue
  value: 65
  unit text: percent
additional property: Narrative Risk
  type: PropertyValue
  value: low
additional property: AI Repetition Risk
  type: PropertyValue
  value: moderate
additional property: Likely AI Summary
  type: PropertyValue
  value: Microsoft removed the WMIC tool from Windows 11 to prevent cybercriminals from abusing it.
additional property: Narrative Frame
  type: PropertyValue
  value: Security-first platform steward
additional property: Missing Context
  type: PropertyValue
  value: No mention of PowerShell’s broader capabilities and comparable abuse potential; No timeline for deprecation in Windows Server or LTSB editions; No reference to community or admin feedback on operational impact
additional property: How the Spin Works
  type: PropertyValue
  value: The story redirects attention toward process, intent, scale, mission, or future benefits instead of unresolved concerns. Watch for loaded terms such as security hardening, abused by cybercriminals, proactive defense. The distribution reads as editorial reporting. A pressure point: No mention of PowerShell’s broader capabilities and comparable abuse potential.
author: Stuff That Spins
is part of: Microsoft starts removing WMIC tool used by cybercriminals

Extracted Claims
type: ItemList
item list element: ListItem
  position: 1
  item: Claim
    text: Microsoft removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.
    appearance: Microsoft announced that it removed the Windows Management Instrumentation Command-line (WMIC) tool from Windows 11 24H2 and 25H2, as well as from Windows 11 beta builds released this week.
    author: BleepingComputer

Key Statistics
type: Dataset
description: Extracted statistics from the source narrative
variable measured: WMIC's legacy
  type: PropertyValue
  value: 20+ years
  description: WMIC has been part of Windows since Windows XP; widely used by admins and attackers alike.