Skip to main content
CPEBuddy
DEF CON 34 - Main - A Provider for the MOFia Distributed Post Ex Capabilities - Steven Flores

DEF CON 34 - Main - A Provider for the MOFia Distributed Post Ex Capabilities - Steven Flores

Source: YouTube · DEFCONConference · published Nov 6, 2026 · 42:25

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

Stephen Flores (SpecterOps) demonstrates distributed post-exploitation that runs entirely over WMI—installing offensive providers remotely with no new processes or agents 0:13.

Key Takeaways:
• WMI is Microsoft's WBEM/CIM implementation, accessed via DCOM/RPC or WSMan; the service loads providers in-process to perform OS actions 1:47
• Most WMI detections only cover Win32_Process creation and registry writes, ignoring far broader capability 6:17
• MSFT_Process (Server 2016+) offers alternate process creation plus diskless remote process dumping via dbghelp.dll's MiniDump 9:31
• Providers can be installed purely over WMI by replicating MOFComp via DCOM PutClass/PutInstance calls using the WMIO protocol spec, plus StdRegProv key creation 15:28
• File reads use the PowerShellv3 class; writes use DSC's Local Configuration Manager classes, avoiding detections that fire on StdRegProv 18:45
• Two tools released: WMI Client (SMBExec-like, native classes only, AMSI/ETW/SBL tampering) and Dopio, which installs benignly-named providers (execution, secretsdump, Kerberos, cookie dumping) running as SYSTEM in WmiPrvSE, then uninstalls cleanly 27:01
• Detection: Event ID 63 for system-hosting-model provider registration, unsigned DLLs in the WBEM directory, unusual registry class IDs, and PowerShell script-block logging 38:34

This talk reframes WMI as a complete, agentless post-exploitation platform while giving defenders concrete detection signals.

Sources:

  • 0:13 Talk introduction
  • 6:17 Narrow scope of current WMI detections
  • 9:31 MSFT_Process and diskless dumping
  • 15:28 Remote provider installation over DCOM
  • 18:45 File read/write primitives
  • 27:01 WMI Client and Dopio release
  • 38:34 Detection guidance

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Stephen Flores here will be here to talk to us about some uh Windows uh hacking or post exploitation. >> Cool. Thank you. Yeah. So, um as was stated, my name is Steven Flores. Today I'll be talking about uh or my talk will be called a provider for the mafia uh distri distributed postex capabilities. So, just a little bit about me, a little background. Uh I'm a senior offensive security engineer at Spectre Ops. Um basically what I my job entails I work on the trace team. Uh what my job entails is uh providing help or postex capability for any of our consultants uh on the adsim team uh or anywhere they might need like any assistance on anything. Um but some of my interests are doing research capability dev initial access stuff payload stuff things like that. Uh if you are on any socials like…