Stealthy WMI lateral movement - StealthyWMIExec.py Recently, I started reading wmiexec.py to learn how to write WMI with Impacket scripts. however, I saw how easy it was to detect WMIExec, because WMIexec uses the Win32_Process class and also uses the Create Method to spawn a process (for example powershell.exe). and the output of the result was \\\\127.0.0.1\\ADMIN$\__(time).