More Fun With WMI

This post details the WMI class **MSFT_MTProcess** as a near drop-in alternative to **Win32_Process** for lateral movement and process dumping, highlighting its CreateProcess and CreateDump methods, default availability on Windows Server 2016+ (and optional installation on workstations via provider DLL/MOF registration), and operational considerations such as namespace differences and telemetry. It introduces tooling—WMI_Proc_Dump.py for remote process dumps and mtprocess.py for remote execution and provider installation—positioning MSFT_MTProcess as a practical TTP for post-exploitation on modern Windows environments.