T1047 Google Chronicle · YARA-L

Detect Windows Management Instrumentation in Google Chronicle

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is a built-in Windows administration framework that provides a uniform interface for accessing system components, processes, services, and hardware. Adversaries leverage WMI for local and remote command execution, process creation via Win32_Process, service manipulation, shadow copy deletion, and lateral movement via DCOM (port 135) or WinRM (port 5985/5986). The wmic.exe CLI tool has been widely abused but is deprecated in Windows 11+; modern attacks increasingly use PowerShell cmdlets (Invoke-WmiMethod, Get-CimInstance) and direct COM APIs. Real-world abusers include Emotet (WMI to launch PowerShell), SUNBURST (Win32_SystemDriver enumeration), INC Ransom (WMIC-based ransomware deployment), menuPass (wmiexec.vbs lateral movement), Gamaredon Group, and numerous ransomware families that delete shadow copies via wmic.exe.

MITRE ATT&CK

Tactic
Execution
Technique
T1047 Windows Management Instrumentation
Canonical reference
https://attack.mitre.org/techniques/T1047/

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule wmi_abuse_t1047 {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects WMI abuse via wmic.exe suspicious args, WmiPrvSE.exe spawning unexpected children, or PowerShell WMI class/cmdlet execution"
    technique = "T1047"
    tactic = "Execution"
    severity = "HIGH"
    confidence = "HIGH"
    reference = "https://attack.mitre.org/techniques/T1047/"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        // Branch 1: wmic.exe with suspicious arguments
        re.regex($e.target.process.file.full_path, `(?i)\\wmic\.exe$`) and
        re.regex($e.target.process.command_line,
          `(?i)(process\s+call\s+create|shadowcopy\s+(delete|where)|\/node:|os\s+get|computersystem\s+get|service\s+where|nicconfig|logicaldisk\s+get|startup\s+list|useraccount\s+get)`)
      ) or
      (
        // Branch 2: WmiPrvSE.exe spawning unexpected child processes
        re.regex($e.principal.process.file.full_path, `(?i)\\wmiprvse\.exe$`) and
        not re.regex($e.target.process.file.full_path,
          `(?i)\\(wmiprvse|msiexec|svchost|searchindexer|werfault|dllhost)\.exe$`)
      ) or
      (
        // Branch 3: PowerShell executing via WMI classes or cmdlets
        re.regex($e.target.process.file.full_path, `(?i)\\(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line,
          `(?i)(invoke-wmimethod|get-wmiobject|get-ciminstance|\[wmiclass\]|\[wmi\]|win32_process|win32_shadowcopy|win32_service|wmiexec)`) and
        re.regex($e.target.process.command_line,
          `(?i)(create|startservice|delete|invoke|exec|callmethod)`)
      )
    )

  condition:
    $e
}
high severity high confidence

Chronicle YARA-L 2.0 rule detecting Windows Management Instrumentation abuse (T1047) using UDM PROCESS_LAUNCH events. Covers three behavioral patterns mapped from existing KQL/SPL detections: wmic.exe invoked with suspicious enumeration or remote execution arguments (including shadow copy deletion via shadowcopy delete/where and remote node targeting via /node:), WmiPrvSE.exe spawning non-allowlisted child processes as a signal for WMI-based lateral movement or local code execution, and PowerShell invoking WMI APIs (Win32_Process, Invoke-WmiMethod, Get-CimInstance, wmiexec) to create processes or manipulate services.

Data Sources

Google Chronicle UDMWindows Endpoint Telemetry via Chronicle ForwarderSysmon Event ID 1 normalized to UDM PROCESS_LAUNCH

Required Tables

UDM PROCESS_LAUNCH events

False Positives & Tuning

  • Enterprise endpoint management platforms (Tanium, BigFix, Altiris) that use wmic.exe for periodic hardware and OS inventory collection, generating computersystem get and logicaldisk get command lines that match reconnaissance argument patterns.
  • WmiPrvSE.exe spawning dllhost.exe variants or vendor-specific management processes during COM/DCOM object instantiation from legitimate WMI providers installed by backup, AV, or monitoring software.
  • DevOps automation (Ansible WinRM modules, PowerShell DSC) running Get-CimInstance or Invoke-WmiMethod in deployment pipelines with remote -ComputerName targeting that matches the remote execution pattern.
Download portable Sigma rule (.yml)

Other platforms for T1047

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1WMI Local Process Creation via wmic.exe

    Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process call create calc.exe'. Second Sysmon Event ID 1: Process Create with Image=calc.exe and ParentImage=WmiPrvSE.exe (note: wmiprvse.exe, not wmic.exe, is the actual parent). Security Event ID 4688 (if command line auditing enabled) for both wmic.exe and calc.exe.

  2. Test 2Remote WMI Process Execution via PowerShell Invoke-WmiMethod

    Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'Invoke-WmiMethod', 'Win32_Process', 'Create', and 'ComputerName'. Second Sysmon Event ID 1: cmd.exe with ParentImage=WmiPrvSE.exe (confirming WMI execution path). PowerShell ScriptBlock Log Event ID 4104 with full Invoke-WmiMethod call. Sysmon Event ID 3: network connection to 127.0.0.1 on port 135 (DCOM).

  3. Test 3WMI System Enumeration and Discovery

    Expected signal: Four separate Sysmon Event ID 1 entries for wmic.exe, each with distinct CommandLine arguments (os get, process list, service where, nicconfig get). Security Event ID 4688 equivalents if audit policy enabled. No network events expected for local-only enumeration. Each invocation generates a process creation event with the full command line.

  4. Test 4WMI Shadow Copy Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'shadowcopy list brief'. Security Event ID 4688 equivalent with command line. No child processes created. No file system modification. The 'shadowcopy' keyword in the CommandLine is the detection trigger.

Last updated: 2026-04-16 Research depth: deep
References (12)

Unlock Pro Content

Get the full detection package for T1047 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance
Sign Up for Pro View Pricing

Related Detections

Related Techniques

T1021.003Distributed Component Object ModelT1021.006Windows Remote ManagementT1059.001PowerShellT1059.003Windows Command ShellT1546.003Windows Management Instrumentation Event SubscriptionT1490Inhibit System RecoveryT1087Account DiscoveryT1057Process DiscoveryT1007System Service DiscoveryT1105Ingress Tool Transfer

Same Tactic: Execution

Popular Detections