T1047

Windows Management Instrumentation

Execution Last updated:

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is a built-in Windows administration framework that provides a uniform interface for accessing system components, processes, services, and hardware. Adversaries leverage WMI for local and remote command execution, process creation via Win32_Process, service manipulation, shadow copy deletion, and lateral movement via DCOM (port 135) or WinRM (port 5985/5986). The wmic.exe CLI tool has been widely abused but is deprecated in Windows 11+; modern attacks increasingly use PowerShell cmdlets (Invoke-WmiMethod, Get-CimInstance) and direct COM APIs. Real-world abusers include Emotet (WMI to launch PowerShell), SUNBURST (Win32_SystemDriver enumeration), INC Ransom (WMIC-based ransomware deployment), menuPass (wmiexec.vbs lateral movement), Gamaredon Group, and numerous ransomware families that delete shadow copies via wmic.exe.

What is T1047 Windows Management Instrumentation?

Windows Management Instrumentation (T1047) maps to the Execution tactic — the adversary is trying to run malicious code in MITRE ATT&CK.

This page provides production-ready detection logic for Windows Management Instrumentation, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Execution
Technique
T1047 Windows Management Instrumentation
Canonical reference
https://attack.mitre.org/techniques/T1047/
Microsoft Sentinel / Defender
kusto 
let SuspiciousWmicArgs = dynamic([
  "process call create",
  "shadowcopy delete",
  "shadowcopy where",
  "/node:",
  "os get",
  "computersystem get",
  "service where",
  "product get",
  "nicconfig",
  "logicaldisk get",
  "startup list",
  "useraccount get"
]);
let SuspiciousWmiPSPatterns = dynamic([
  "Invoke-WmiMethod",
  "Get-WmiObject",
  "Get-CimInstance",
  "[wmiclass]",
  "[wmi]",
  "Win32_Process",
  "Win32_ShadowCopy",
  "Win32_Service",
  "wmiexec"
]);
// Branch 1: wmic.exe executing suspicious operations
let WmicSuspicious = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "wmic.exe"
| where ProcessCommandLine has_any (SuspiciousWmicArgs)
| extend WmicRemote = ProcessCommandLine has "/node:"
| extend ShadowDelete = ProcessCommandLine has_any ("shadowcopy delete", "shadowcopy where")
| extend ProcessExec = ProcessCommandLine has "process call create"
| extend DetectionSource = "wmic_suspicious_args";
// Branch 2: wmiprvse.exe spawning unexpected child processes (WMI-based remote/local exec)
let WmiParentExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName !in~ ("WmiPrvSE.exe", "msiexec.exe", "svchost.exe", "SearchIndexer.exe", "WerFault.exe", "dllhost.exe")
| extend WmicRemote = false
| extend ShadowDelete = false
| extend ProcessExec = true
| extend DetectionSource = "wmiprvse_child_process";
// Branch 3: PowerShell using WMI for process creation or service manipulation
let PSWmiExec = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (SuspiciousWmiPSPatterns)
| where ProcessCommandLine has_any ("Create", "StartService", "Delete", "Invoke", "exec", "CallMethod")
| extend WmicRemote = ProcessCommandLine has_any ("-ComputerName", "/node:")
| extend ShadowDelete = ProcessCommandLine has "ShadowCopy"
| extend ProcessExec = ProcessCommandLine has_any ("Win32_Process", "Invoke-WmiMethod", "Invoke-CimMethod")
| extend DetectionSource = "powershell_wmi_exec";
union WmicSuspicious, WmiParentExec, PSWmiExec
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         WmicRemote, ShadowDelete, ProcessExec, DetectionSource
| sort by Timestamp desc

Detects Windows Management Instrumentation abuse across three distinct patterns using Microsoft Defender for Endpoint DeviceProcessEvents. Branch 1 identifies wmic.exe with suspicious arguments including process creation, shadow copy deletion, and remote /node: targeting. Branch 2 identifies processes spawned by wmiprvse.exe that fall outside expected system behaviors, indicating WMI-triggered remote or local code execution. Branch 3 identifies PowerShell leveraging WMI cmdlets for process or service manipulation. Results are unioned and enriched with indicator flags for analyst triage.

high severity high confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • System administrators using wmic.exe or PowerShell WMI cmdlets for legitimate remote management (asset inventory, service health checks, software deployment)
  • Backup agents and VSS-aware applications that enumerate or interact with shadow copies via WMI (e.g., Veeam, Acronis, Windows Server Backup)
  • Enterprise monitoring tools (SCCM, SCOM, SolarWinds, Tanium) that spawn processes via wmiprvse.exe during scheduled inventory collection or remediation tasks
  • Security scanners and vulnerability assessment tools (Tenable, Qualys, Rapid7) that use WMI to enumerate installed software, OS configuration, and services
  • IT automation scripts (Ansible over WinRM, custom PowerShell DSC configurations) that legitimately use Win32_Process or Win32_Service classes
  • Windows Update and Windows Installer operations that trigger wmiprvse.exe child process spawning during patch installation

Sigma rule & cross-platform mapping

The detection logic for Windows Management Instrumentation (T1047) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1047 Sigma rules on detection.fyi

Platform-specific guides for T1047

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-16 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1WMI Local Process Creation via wmic.exe

    Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process call create calc.exe'. Second Sysmon Event ID 1: Process Create with Image=calc.exe and ParentImage=WmiPrvSE.exe (note: wmiprvse.exe, not wmic.exe, is the actual parent). Security Event ID 4688 (if command line auditing enabled) for both wmic.exe and calc.exe.

  2. Test 2Remote WMI Process Execution via PowerShell Invoke-WmiMethod

    Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'Invoke-WmiMethod', 'Win32_Process', 'Create', and 'ComputerName'. Second Sysmon Event ID 1: cmd.exe with ParentImage=WmiPrvSE.exe (confirming WMI execution path). PowerShell ScriptBlock Log Event ID 4104 with full Invoke-WmiMethod call. Sysmon Event ID 3: network connection to 127.0.0.1 on port 135 (DCOM).

  3. Test 3WMI System Enumeration and Discovery

    Expected signal: Four separate Sysmon Event ID 1 entries for wmic.exe, each with distinct CommandLine arguments (os get, process list, service where, nicconfig get). Security Event ID 4688 equivalents if audit policy enabled. No network events expected for local-only enumeration. Each invocation generates a process creation event with the full command line.

  4. Test 4WMI Shadow Copy Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'shadowcopy list brief'. Security Event ID 4688 equivalent with command line. No child processes created. No file system modification. The 'shadowcopy' keyword in the CommandLine is the detection trigger.

Response Playbook

Triage

  1. Identify the execution context: was wmic.exe or wmiprvse.exe spawned by an expected parent (services.exe, svchost.exe, legitimate admin tool) or an unusual one (Office application, browser, script interpreter, email client)?
  2. Examine the full command line for high-risk operations: 'process call create' (direct process execution), 'shadowcopy delete' (ransomware precursor), '/node:' with external or lateral movement targets, or encoded PowerShell payloads as arguments to Win32_Process.Create()
  3. Check the initiating user account: is this a named user, service account, or SYSTEM? Would this account typically perform WMI operations? Correlate against HR/IT change tickets if available
  4. For wmiprvse.exe child process alerts: identify what process was spawned and its own command line. cmd.exe, powershell.exe, certutil.exe, mshta.exe, or LOLBins spawned by wmiprvse.exe are high-priority escalation indicators
  5. Check for lateral movement indicators: is /node: targeting other systems in the environment? Pull DeviceNetworkEvents for the source host to identify DCOM port 135 or WinRM port 5985/5986 connections to internal hosts
  6. Review timeline context: what processes ran immediately before and after the WMI activity? Look for credential access (lsass.exe access), reconnaissance tools, or subsequent network connections to external IPs
  7. Query for persistence mechanisms: did the WMI activity create any new scheduled tasks, services, registry run keys, or WMI subscriptions (check WMI-Activity event log and Sysmon Event ID 19/20/21)?

Containment

  1. If active compromise confirmed (C2 beaconing, lateral movement in progress): isolate the endpoint immediately using EDR network isolation to prevent further spread while preserving volatile artifacts for forensics
  2. If /node: remote WMI execution detected to other systems: isolate all targeted remote hosts as well — they may already be compromised; prioritize hosts with elevated privileges (DCs, file servers, jump hosts)
  3. If shadow copies deleted (ShadowDelete=1): immediately escalate to incident commander — this is a ransomware precursor; initiate ransomware response playbook and preserve any remaining VSS snapshots from backup infrastructure
  4. If compromised service account or domain admin credentials used: immediately force password reset, revoke Kerberos tickets (klist purge on affected hosts), and audit all systems that account accessed in the past 24–72 hours
  5. Block the initiating process hash at the EDR level if the parent process is identified as malicious (e.g., malicious script or dropper that called WMI)
  6. If PowerShell-based WMI execution: review and quarantine any scripts or files written to disk by the PowerShell process; check temp directories, user AppData, and ProgramData

Evidence Collection

  1. WMI Activity Event Log: Microsoft-Windows-WMI-Activity/Operational — Event ID 5857 (provider load), 5858 (provider error), 5859 (filter activity), 5860 (consumer activity), 5861 (filter/consumer binding) for WMI subscription persistence
  2. Process creation logs: Sysmon Event ID 1 with full command lines for wmic.exe, wmiprvse.exe, and any child processes; Security Event ID 4688 if enhanced audit policy is enabled with process command line logging
  3. Network connections: Sysmon Event ID 3 for DCOM (port 135) and WinRM (port 5985/5986) connections; DeviceNetworkEvents in MDE for remote WMI targeting
  4. PowerShell ScriptBlock Logging (Event ID 4104) if WMI was invoked via PowerShell — captures full deobfuscated WMI method calls and parameters
  5. VSS/Shadow Copy state: run 'vssadmin list shadows' and 'Get-WmiObject Win32_ShadowCopy' from an unaffected system to document current shadow copy inventory before and after incident
  6. Registry artifacts: HKLM\SOFTWARE\Microsoft\WBEM\ESS for WMI subscriptions; HKLM\SYSTEM\CurrentControlSet\Services\winmgmt for WMI service configuration
  7. File system: %SystemRoot%\System32\wbem\Repository — WMI repository files (OBJECTS.DATA, INDEX.BTR) for forensic WMI subscription analysis using tools like PyWMIPersistenceFinder
  8. Memory acquisition if process injection or fileless payload suspected: full memory image to recover in-memory WMI scripts or payloads that were never written to disk
  9. Windows Defender / AMSI logs: Event ID 1116 in Microsoft-Windows-Windows Defender/Operational if WMI-invoked scripts triggered endpoint protection alerts

Escalation Criteria

  • ! Shadow copy deletion detected (wmic shadowcopy delete or Win32_ShadowCopy.Delete()) — immediate escalation; this is a near-certain ransomware preparation step
  • ! wmiprvse.exe spawning PowerShell, cmd.exe, or known post-exploitation tools (mshta.exe, rundll32.exe, certutil.exe) — indicates successful WMI-based remote code execution
  • ! Remote WMI (/node:) targeting domain controllers, file servers, or backup infrastructure — indicates lateral movement toward high-value targets
  • ! WMI process creation (Win32_Process.Create) with Base64-encoded or obfuscated payloads passed as the command argument — strong indicator of fileless malware execution
  • ! WMI subscription creation detected (Sysmon Event ID 19/20/21 or WMI-Activity Event IDs 5859/5861) — indicates adversary establishing WMI-based persistence mechanism
  • ! Multiple endpoints showing WMI-based process creation from the same source system within a short time window — indicates automated lateral movement (wmiexec, Impacket, similar frameworks)
  • ! WMI activity on accounts that have no business justification for WMI usage, especially service accounts, generic accounts, or recently created accounts

Investigation Guide

Forensic Artifacts

  • > WMI Repository: %SystemRoot%\System32\wbem\Repository\OBJECTS.DATA — contains persistent WMI class definitions, subscriptions, and stored queries; analyze with PyWMIPersistenceFinder or wmi-forensics tools
  • > Event Log: Microsoft-Windows-WMI-Activity/Operational — Event ID 5861 records WMI filter-to-consumer binding creation (persistence); Event ID 5858 records WMI errors including failed enumeration attempts
  • > Prefetch: C:\Windows\Prefetch\WMIC.EXE-*.pf — execution timestamps, loaded DLLs, and file references from wmic.exe runs
  • > Prefetch: C:\Windows\Prefetch\WMIPRVSE.EXE-*.pf — documents wmiprvse.exe execution and child process artifacts
  • > Registry: HKLM\SOFTWARE\Microsoft\WBEM\ESS — WMI Event Subscription namespace, filter names, consumer names for persistence detection
  • > Registry: HKLM\SYSTEM\CurrentControlSet\Services\winmgmt — WMI service configuration and startup type changes
  • > Sysmon Event IDs 19/20/21: WmiEventFilter, WmiEventConsumer, WmiEventConsumerToFilter — logged when WMI subscriptions are created or modified
  • > ShimCache / AppCompatCache: Records wmic.exe execution even when Prefetch is disabled, with last execution timestamps
  • > AmCache.hve: %SystemRoot%\AppCompat\Programs\Amcache.hve — records SHA1 hash and execution metadata for wmic.exe and processes it spawned
  • > Network connections: Windows Firewall log or NetFlow data for DCOM port 135 traffic or WinRM port 5985/5986 between hosts to trace remote WMI targeting paths

Tuning Guidance

Begin by inventorying legitimate WMI users in your environment. The primary sources of false positives are enterprise management platforms (SCCM/ConfigMgr, SCOM, Tanium, Kaseya, ConnectWise) that heavily use wmiprvse.exe and wmic.exe for asset management and remediation. Build an allowlist of known-good parent processes for wmiprvse.exe child process spawning — typical legitimate parents include services.exe, svchost.exe, and specific management agent executables. For wmic.exe alerts, allowlist specific service account + command line combinations used by management tools, but never allowlist on command line patterns alone — always include the initiating process and account context. The ShadowDelete detection should NEVER be suppressed regardless of the parent process or account context — legitimate operations do not delete shadow copies via wmic.exe in production environments. For environments using PowerShell DSC or Ansible over WinRM, the PSWmiExec branch will generate noise; consider requiring both Win32_Process AND Create/Invoke in the same command line, and exclude specific known automation account names. Enable WMI Activity logging (Microsoft-Windows-WMI-Activity/Operational) and Sysmon Event IDs 19/20/21 for WMI subscription monitoring — these are low-volume, high-signal sources that require no tuning and surface persistence mechanisms that the process-creation queries cannot detect.

Hunting Queries

Threat hunt for unusual processes spawned by wmiprvse.exe over the past 7 days. Establishes a baseline of what WMI legitimately executes in the environment and surfaces anomalous child processes. High-frequency unexpected children (cmd.exe, powershell.exe, mshta.exe, cscript.exe) from wmiprvse.exe are strong lateral movement indicators. Use Devices count to assess blast radius.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "wmiprvse.exe"
| where FileName !in~ ("WmiPrvSE.exe", "msiexec.exe", "svchost.exe", "SearchIndexer.exe",
                        "WerFault.exe", "dllhost.exe", "TiWorker.exe", "MpCopyAccelerator.exe")
| summarize
    ChildProcesses=make_set(FileName),
    CommandLines=make_set(ProcessCommandLine),
    Count=count(),
    Devices=dcount(DeviceName),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
  by FileName, AccountName
| sort by Count desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ParentImage="*\\wmiprvse.exe"
  NOT (Image="*\\wmiprvse.exe" OR Image="*\\msiexec.exe" OR Image="*\\svchost.exe" OR Image="*\\werfault.exe" OR Image="*\\dllhost.exe" OR Image="*\\searchindexer.exe")
| stats count as Count, dc(host) as Devices, values(CommandLine) as CommandLines, earliest(_time) as FirstSeen, latest(_time) as LastSeen by Image, User
| sort - Count

Threat hunt for WMI-related lateral movement by identifying hosts making DCOM (port 135) or WinRM (5985/5986) connections to multiple targets. High target counts from a single source indicate automated lateral movement tools (Impacket wmiexec, custom scripts). Any wmiprvse.exe or wmic.exe connections to public IPs are highly anomalous and warrant immediate investigation.

Hunting — KQL
kql 
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "wmic.exe"
   or (InitiatingProcessFileName =~ "svchost.exe" and RemotePort in (135, 5985, 5986))
   or (InitiatingProcessFileName =~ "wmiprvse.exe" and RemoteIPType == "Public")
| where RemoteIPType == "Public" or RemotePort in (135, 5985, 5986)
| summarize
    Targets=dcount(RemoteIP),
    Ports=make_set(RemotePort),
    Connections=count(),
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where Targets > 2 or Connections > 10
| sort by Targets desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  (Image="*\\wmic.exe" OR (DestinationPort IN (135, 5985, 5986) AND (Image="*\\wmiprvse.exe" OR Image="*\\svchost.exe")))
| eval IsPublic=if(NOT (match(DestinationIp, "^10\.") OR match(DestinationIp, "^172\.(1[6-9]|2[0-9]|3[01])\.") OR match(DestinationIp, "^192\.168\.") OR match(DestinationIp, "^127\.")), 1, 0)
| where DestinationPort IN (135, 5985, 5986) OR IsPublic=1
| stats dc(DestinationIp) as Targets, count as Connections, values(DestinationPort) as Ports, earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, Image, CommandLine
| where Targets > 2 OR Connections > 10
| sort - Targets

Threat hunt specifically for shadow copy deletion activity via WMI — a critical ransomware preparation indicator. Groups activity by hour and device to identify coordinated multi-host campaigns. Any detection here should be treated as a critical incident and trigger the ransomware response playbook immediately. Look for correlating file encryption activity (high file write volume) within the same time window.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "wmic.exe"
| where ProcessCommandLine has_any ("shadowcopy delete", "shadowcopy where DeleteCount", "Win32_ShadowCopy")
| summarize
    Count=count(),
    Devices=dcount(DeviceName),
    Accounts=make_set(AccountName),
    Commands=make_set(ProcessCommandLine),
    FirstSeen=min(Timestamp)
  by bin(Timestamp, 1h), DeviceName
| sort by FirstSeen desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  Image="*\\wmic.exe"
  (CommandLine="*shadowcopy delete*" OR CommandLine="*shadowcopy where*" OR CommandLine="*Win32_ShadowCopy*")
| bin _time span=1h
| stats count as Count, dc(host) as Devices, values(User) as Accounts, values(CommandLine) as Commands, earliest(_time) as FirstSeen by _time, host
| sort - _time

Atomic Red Team Tests

Test 1 WMI Local Process Creation via wmic.exe
windows

Executes a process (calc.exe) using wmic.exe process call create — the most direct and commonly observed WMI execution technique. This mirrors how threat actors launch payloads locally after initial access without directly spawning a cmd.exe or PowerShell. The calc.exe target is benign but the process creation telemetry is identical to malicious usage.

Command

powershell 
wmic.exe process call create "calc.exe"

Cleanup

powershell 
taskkill /IM calc.exe /F 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process call create calc.exe'. Second Sysmon Event ID 1: Process Create with Image=calc.exe and ParentImage=WmiPrvSE.exe (note: wmiprvse.exe, not wmic.exe, is the actual parent). Security Event ID 4688 (if command line auditing enabled) for both wmic.exe and calc.exe.

Expected Detection

Alert fires on 'process call create' pattern in wmic.exe CommandLine. KQL: ProcessExec=true, DetectionSource='wmic_suspicious_args'. SPL: ProcessCreate=1, WmicSuspiciousArgs=1, SuspicionScore >= 2. Second alert fires on wmiprvse.exe spawning calc.exe (WmiprvseChild=1).

Test 2 Remote WMI Process Execution via PowerShell Invoke-WmiMethod
windows

Uses PowerShell's Invoke-WmiMethod against localhost to simulate remote WMI-based lateral movement using the Win32_Process class. This technique is used by threat actors and frameworks like Impacket (wmiexec), Metasploit, and custom tooling to execute commands on remote targets without dropping files to disk. Targeting localhost keeps this test safe while generating identical telemetry to remote execution.

Command

powershell 
powershell.exe -NoProfile -Command "Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList 'cmd.exe /c whoami > C:\Windows\Temp\wmi-test-output.txt' -ComputerName localhost"

Cleanup

powershell 
Remove-Item C:\Windows\Temp\wmi-test-output.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'Invoke-WmiMethod', 'Win32_Process', 'Create', and 'ComputerName'. Second Sysmon Event ID 1: cmd.exe with ParentImage=WmiPrvSE.exe (confirming WMI execution path). PowerShell ScriptBlock Log Event ID 4104 with full Invoke-WmiMethod call. Sysmon Event ID 3: network connection to 127.0.0.1 on port 135 (DCOM).

Expected Detection

Alert fires on PowerShell WMI execution branch. KQL: PSWmiExec=true, WmicRemote=true, ProcessExec=true, DetectionSource='powershell_wmi_exec'. SPL: PSWmiExec=1, WmicRemote=1, SuspicionScore >= 3. Second alert for wmiprvse.exe spawning cmd.exe (WmiprvseChild=1).

Test 3 WMI System Enumeration and Discovery
windows

Performs a series of WMI-based discovery commands observed in threat actor toolkits (SUNBURST used Win32_SystemDriver, RogueRobin used WMI to detect sandboxes, BlackEnergy gathered victim details via WMI). These commands enumerate OS version, running processes, installed services, and network configuration — all standard post-compromise reconnaissance steps.

Command

powershell 
wmic.exe os get Caption,Version,BuildNumber,OSArchitecture /format:list & wmic.exe process list brief & wmic.exe service where "State='Running'" get Name,PathName & wmic.exe nicconfig get IPAddress,MACAddress,DefaultIPGateway

Expected Telemetry

Four separate Sysmon Event ID 1 entries for wmic.exe, each with distinct CommandLine arguments (os get, process list, service where, nicconfig get). Security Event ID 4688 equivalents if audit policy enabled. No network events expected for local-only enumeration. Each invocation generates a process creation event with the full command line.

Expected Detection

Alerts fire on 'os get', 'service where', 'nicconfig get' pattern matches. KQL: WmicSuspiciousArgs=true for multiple events. SPL: WmicSuspiciousArgs=1 on multiple rows. Individual commands score SuspicionScore=1 each; the pattern of repeated wmic.exe execution for reconnaissance is detectable via count-over-time hunting queries.

Test 4 WMI Shadow Copy Enumeration
windows

Enumerates existing VSS shadow copies via WMI — the precursor step that ransomware operators use before deleting them (e.g., INC Ransom, Meteor, FIVEHANDS). This test runs the safe enumeration version only (list, not delete) to generate telemetry matching ransomware reconnaissance behavior without destructive action. The detection fires on the 'shadowcopy' keyword regardless of whether delete follows.

Command

powershell 
wmic.exe shadowcopy list brief

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'shadowcopy list brief'. Security Event ID 4688 equivalent with command line. No child processes created. No file system modification. The 'shadowcopy' keyword in the CommandLine is the detection trigger.

Expected Detection

Alert fires on 'shadowcopy' keyword in wmic.exe CommandLine. KQL: WmicSuspiciousArgs=true (shadowcopy pattern), DetectionSource='wmic_suspicious_args'. SPL: WmicSuspiciousArgs=1, SuspicionScore >= 1. Analysts should treat any shadowcopy WMI interaction as requiring triage — the distinction between 'list' and 'delete' is only one additional argument.

Related Detections

Tactic Hub

TA0002Execution

Related Techniques

T1021.003Distributed Component Object ModelT1021.006Windows Remote ManagementT1059.001PowerShellT1059.003Windows Command ShellT1546.003Windows Management Instrumentation Event SubscriptionT1490Inhibit System RecoveryT1087Account DiscoveryT1057Process DiscoveryT1007System Service DiscoveryT1105Ingress Tool Transfer

Same Tactic: Execution

Popular Detections