Detect Windows Management Instrumentation in CrowdStrike LogScale
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is a built-in Windows administration framework that provides a uniform interface for accessing system components, processes, services, and hardware. Adversaries leverage WMI for local and remote command execution, process creation via Win32_Process, service manipulation, shadow copy deletion, and lateral movement via DCOM (port 135) or WinRM (port 5985/5986). The wmic.exe CLI tool has been widely abused but is deprecated in Windows 11+; modern attacks increasingly use PowerShell cmdlets (Invoke-WmiMethod, Get-CimInstance) and direct COM APIs. Real-world abusers include Emotet (WMI to launch PowerShell), SUNBURST (Win32_SystemDriver enumeration), INC Ransom (WMIC-based ransomware deployment), menuPass (wmiexec.vbs lateral movement), Gamaredon Group, and numerous ransomware families that delete shadow copies via wmic.exe.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1047 Windows Management Instrumentation
- Canonical reference
- https://attack.mitre.org/techniques/T1047/
LogScale Detection Query
#event_simpleName=ProcessRollup2
| ImageFileName =~ regex("(?i)wmic\\.exe$", field=ImageFileName)
OR ParentBaseFileName =~ "wmiprvse.exe"
OR ImageFileName =~ regex("(?i)(powershell|pwsh)\\.exe$", field=ImageFileName)
| eval WmicSuspicious = if(
ImageFileName =~ regex("(?i)wmic\\.exe$") AND
CommandLine =~ regex("(?i)(process\\s+call\\s+create|shadowcopy\\s+(delete|where)|\/node:|os\\s+get|computersystem\\s+get|service\\s+where|nicconfig|logicaldisk\\s+get|useraccount\\s+get)"),
1, 0)
| eval WmicRemote = if(CommandLine =~ regex("\/node:"), 1, 0)
| eval ShadowDelete = if(CommandLine =~ regex("(?i)shadowcopy\\s+(delete|where)"), 1, 0)
| eval ProcessCreate = if(CommandLine =~ regex("(?i)process\\s+call\\s+create"), 1, 0)
| eval WmiprvseChild = if(
ParentBaseFileName =~ regex("(?i)wmiprvse\\.exe$") AND
NOT ImageFileName =~ regex("(?i)(wmiprvse|msiexec|svchost|searchindexer|werfault|dllhost)\\.exe$"),
1, 0)
| eval PSWmiExec = if(
ImageFileName =~ regex("(?i)(powershell|pwsh)\\.exe$") AND
CommandLine =~ regex("(?i)(invoke-wmimethod|get-wmiobject|get-ciminstance|\\[wmiclass\\]|win32_process|win32_shadowcopy|win32_service|wmiexec)") AND
CommandLine =~ regex("(?i)(create|startservice|delete|invoke|exec|callmethod)"),
1, 0)
| eval SuspicionScore = WmicSuspicious + WmicRemote + ShadowDelete + ProcessCreate + WmiprvseChild + PSWmiExec
| where SuspicionScore > 0
| table [@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, ParentCommandLine, WmicSuspicious, WmiprvseChild, PSWmiExec, WmicRemote, ShadowDelete, ProcessCreate, SuspicionScore]
| sort(@timestamp, order=desc)Detects WMI abuse (T1047) using CrowdStrike Falcon ProcessRollup2 telemetry. Three behavioral branches are evaluated: wmic.exe invoked with suspicious arguments covering process creation, shadow copy deletion, remote /node: targeting, and system reconnaissance (os get, nicconfig, useraccount get); wmiprvse.exe spawning non-allowlisted child processes signaling WMI-based code execution via local or remote WMI; and PowerShell using WMI classes or cmdlets (Win32_Process, Invoke-WmiMethod, Get-CimInstance, wmiexec) combined with execution or destructive action keywords. A SuspicionScore field aggregates matched signals for analyst prioritization.
Data Sources
Required Tables
False Positives & Tuning
- IT management and RMM tools (ConnectWise Automate, NinjaRMM, Datto RMM) that use wmic.exe queries for device inventory and monitoring, generating patterns matching os get, computersystem get, and logicaldisk get argument signatures.
- Hypervisor guest introspection agents (VMware Tools, Hyper-V Integration Services) that spawn as child processes of WmiPrvSE.exe during host-initiated WMI provider calls for VM state reporting.
- Security products performing WMI-based live response or forensic data collection (CrowdStrike Real Time Response, Carbon Black, SentinelOne remote shell) that invoke WMI APIs from PowerShell for system enumeration during incident response workflows.
Other platforms for T1047
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WMI Local Process Creation via wmic.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process call create calc.exe'. Second Sysmon Event ID 1: Process Create with Image=calc.exe and ParentImage=WmiPrvSE.exe (note: wmiprvse.exe, not wmic.exe, is the actual parent). Security Event ID 4688 (if command line auditing enabled) for both wmic.exe and calc.exe.
- Test 2Remote WMI Process Execution via PowerShell Invoke-WmiMethod
Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'Invoke-WmiMethod', 'Win32_Process', 'Create', and 'ComputerName'. Second Sysmon Event ID 1: cmd.exe with ParentImage=WmiPrvSE.exe (confirming WMI execution path). PowerShell ScriptBlock Log Event ID 4104 with full Invoke-WmiMethod call. Sysmon Event ID 3: network connection to 127.0.0.1 on port 135 (DCOM).
- Test 3WMI System Enumeration and Discovery
Expected signal: Four separate Sysmon Event ID 1 entries for wmic.exe, each with distinct CommandLine arguments (os get, process list, service where, nicconfig get). Security Event ID 4688 equivalents if audit policy enabled. No network events expected for local-only enumeration. Each invocation generates a process creation event with the full command line.
- Test 4WMI Shadow Copy Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'shadowcopy list brief'. Security Event ID 4688 equivalent with command line. No child processes created. No file system modification. The 'shadowcopy' keyword in the CommandLine is the detection trigger.
References (12)
- https://attack.mitre.org/techniques/T1047/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
- https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/ba-p/4039242
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/reports
- https://github.com/nccgroup/wmi-forensics
- https://www.secureworks.com/blog/wmi-persistence
- https://www.cybereason.com/blog/wmi-lateral-movement-win32-process
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
Unlock Pro Content
Get the full detection package for T1047 including response playbook, investigation guide, and atomic red team tests.