Detect Windows Management Instrumentation in Elastic Security
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is a built-in Windows administration framework that provides a uniform interface for accessing system components, processes, services, and hardware. Adversaries leverage WMI for local and remote command execution, process creation via Win32_Process, service manipulation, shadow copy deletion, and lateral movement via DCOM (port 135) or WinRM (port 5985/5986). The wmic.exe CLI tool has been widely abused but is deprecated in Windows 11+; modern attacks increasingly use PowerShell cmdlets (Invoke-WmiMethod, Get-CimInstance) and direct COM APIs. Real-world abusers include Emotet (WMI to launch PowerShell), SUNBURST (Win32_SystemDriver enumeration), INC Ransom (WMIC-based ransomware deployment), menuPass (wmiexec.vbs lateral movement), Gamaredon Group, and numerous ransomware families that delete shadow copies via wmic.exe.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1047 Windows Management Instrumentation
- Canonical reference
- https://attack.mitre.org/techniques/T1047/
Elastic Detection Query
any where
(
(
event.category == "process" and event.type == "start" and
process.name : "wmic.exe" and
process.command_line : ("*process call create*", "*shadowcopy delete*", "*shadowcopy where*", "*/node:*", "*os get*", "*computersystem get*", "*service where*", "*nicconfig*", "*logicaldisk get*", "*startup list*", "*useraccount get*")
) or
(
event.category == "process" and event.type == "start" and
process.parent.name : "WmiPrvSE.exe" and
not process.name : ("WmiPrvSE.exe", "msiexec.exe", "svchost.exe", "SearchIndexer.exe", "WerFault.exe", "dllhost.exe")
) or
(
event.category == "process" and event.type == "start" and
process.name : ("powershell.exe", "pwsh.exe") and
process.command_line : ("*Invoke-WmiMethod*", "*Get-WmiObject*", "*Get-CimInstance*", "*[wmiclass]*", "*[wmi]*", "*Win32_Process*", "*Win32_ShadowCopy*", "*Win32_Service*", "*wmiexec*") and
process.command_line : ("*Create*", "*StartService*", "*Delete*", "*Invoke*", "*exec*", "*CallMethod*")
)
)Detects Windows Management Instrumentation (WMI) abuse via three behavioral branches: (1) wmic.exe invoked with suspicious enumeration or execution arguments including shadow copy deletion and remote /node: targeting, (2) WmiPrvSE.exe spawning unexpected child processes indicative of remote or local WMI-based code execution, and (3) PowerShell using WMI classes or cmdlets (Invoke-WmiMethod, Get-CimInstance, Win32_Process) to create processes, manipulate services, or delete shadow copies.
Data Sources
Required Tables
False Positives & Tuning
- SCCM, Ansible, or other IT automation platforms that use wmic.exe for legitimate hardware and software inventory collection (especially computersystem get, logicaldisk get, nicconfig).
- Monitoring and observability agents (e.g., Datadog, Zabbix, SolarWinds) that spawn from or query WMI via wmiprvse.exe for system telemetry.
- Software installation frameworks (InstallShield, Wise, custom MSI wrappers) that invoke WMI during install/uninstall phases, which may spawn unexpected children from WmiPrvSE.exe.
- PowerShell-based administrative scripts used by IT operations to query system state or manage services remotely via Get-WmiObject or Get-CimInstance.
Other platforms for T1047
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WMI Local Process Creation via wmic.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process call create calc.exe'. Second Sysmon Event ID 1: Process Create with Image=calc.exe and ParentImage=WmiPrvSE.exe (note: wmiprvse.exe, not wmic.exe, is the actual parent). Security Event ID 4688 (if command line auditing enabled) for both wmic.exe and calc.exe.
- Test 2Remote WMI Process Execution via PowerShell Invoke-WmiMethod
Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'Invoke-WmiMethod', 'Win32_Process', 'Create', and 'ComputerName'. Second Sysmon Event ID 1: cmd.exe with ParentImage=WmiPrvSE.exe (confirming WMI execution path). PowerShell ScriptBlock Log Event ID 4104 with full Invoke-WmiMethod call. Sysmon Event ID 3: network connection to 127.0.0.1 on port 135 (DCOM).
- Test 3WMI System Enumeration and Discovery
Expected signal: Four separate Sysmon Event ID 1 entries for wmic.exe, each with distinct CommandLine arguments (os get, process list, service where, nicconfig get). Security Event ID 4688 equivalents if audit policy enabled. No network events expected for local-only enumeration. Each invocation generates a process creation event with the full command line.
- Test 4WMI Shadow Copy Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'shadowcopy list brief'. Security Event ID 4688 equivalent with command line. No child processes created. No file system modification. The 'shadowcopy' keyword in the CommandLine is the detection trigger.
References (12)
- https://attack.mitre.org/techniques/T1047/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
- https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/ba-p/4039242
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/reports
- https://github.com/nccgroup/wmi-forensics
- https://www.secureworks.com/blog/wmi-persistence
- https://www.cybereason.com/blog/wmi-lateral-movement-win32-process
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
Unlock Pro Content
Get the full detection package for T1047 including response playbook, investigation guide, and atomic red team tests.