It's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. It has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.