Detect Windows Management Instrumentation in Splunk
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is a built-in Windows administration framework that provides a uniform interface for accessing system components, processes, services, and hardware. Adversaries leverage WMI for local and remote command execution, process creation via Win32_Process, service manipulation, shadow copy deletion, and lateral movement via DCOM (port 135) or WinRM (port 5985/5986). The wmic.exe CLI tool has been widely abused but is deprecated in Windows 11+; modern attacks increasingly use PowerShell cmdlets (Invoke-WmiMethod, Get-CimInstance) and direct COM APIs. Real-world abusers include Emotet (WMI to launch PowerShell), SUNBURST (Win32_SystemDriver enumeration), INC Ransom (WMIC-based ransomware deployment), menuPass (wmiexec.vbs lateral movement), Gamaredon Group, and numerous ransomware families that delete shadow copies via wmic.exe.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1047 Windows Management Instrumentation
- Canonical reference
- https://attack.mitre.org/techniques/T1047/
SPL Detection Query
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval CommandLine_lower=lower(CommandLine)
| eval Image_lower=lower(Image)
| eval ParentImage_lower=lower(ParentImage)
| eval WmicSuspiciousArgs=if(
match(Image_lower, "wmic\.exe") AND
match(CommandLine_lower, "(process\s+call\s+create|shadowcopy\s+(delete|where)|/node:|os\s+get|computersystem\s+get|service\s+where|nicconfig|logicaldisk\s+get|useraccount\s+get)"),
1, 0)
| eval WmicRemote=if(match(CommandLine_lower, "/node:"), 1, 0)
| eval ShadowDelete=if(match(CommandLine_lower, "shadowcopy\s+(delete|where)"), 1, 0)
| eval ProcessCreate=if(match(CommandLine_lower, "process\s+call\s+create"), 1, 0)
| eval WmiprvseChild=if(
match(ParentImage_lower, "wmiprvse\.exe") AND
NOT match(Image_lower, "(wmiprvse|msiexec|svchost|searchindexer|werfault|dllhost)\.exe"),
1, 0)
| eval PSWmiExec=if(
match(Image_lower, "(powershell|pwsh)\.exe") AND
match(CommandLine_lower, "(invoke-wmimethod|get-wmiobject|get-ciminstance|\[wmiclass\]|win32_process|win32_shadowcopy|win32_service|wmiexec)") AND
match(CommandLine_lower, "(create|startservice|delete|invoke|exec|callmethod)"),
1, 0)
| eval SuspicionScore=WmicSuspiciousArgs + WmicRemote + ShadowDelete + ProcessCreate + WmiprvseChild + PSWmiExec
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, WmicSuspiciousArgs, WmicRemote, ShadowDelete, ProcessCreate, WmiprvseChild, PSWmiExec, SuspicionScore
| sort - _timeDetects WMI abuse using Sysmon Event ID 1 (Process Creation) logs. Evaluates five distinct indicator flags: wmic.exe with suspicious arguments, /node: remote targeting, shadow copy deletion, wmiprvse.exe spawning unexpected child processes, and PowerShell WMI execution cmdlets. A cumulative suspicion score aids analyst prioritization. Scores of 2+ indicate higher confidence malicious activity; WmiprvseChild=1 with unusual child executables warrants immediate investigation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Enterprise monitoring and asset management platforms (SCCM, SCOM, Tanium) regularly spawn processes via wmiprvse.exe during scheduled inventory and remediation tasks
- Backup software enumerating VSS/shadow copies via WMI as part of normal pre-backup operations
- IT helpdesk automation using wmic /node: for remote computer management and diagnostics
- Security compliance tools performing WMI-based configuration baseline assessments
- Scripted software deployment that uses Win32_Process.Create() as an installation mechanism
Other platforms for T1047
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1WMI Local Process Creation via wmic.exe
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'process call create calc.exe'. Second Sysmon Event ID 1: Process Create with Image=calc.exe and ParentImage=WmiPrvSE.exe (note: wmiprvse.exe, not wmic.exe, is the actual parent). Security Event ID 4688 (if command line auditing enabled) for both wmic.exe and calc.exe.
- Test 2Remote WMI Process Execution via PowerShell Invoke-WmiMethod
Expected signal: Sysmon Event ID 1: powershell.exe process creation with CommandLine containing 'Invoke-WmiMethod', 'Win32_Process', 'Create', and 'ComputerName'. Second Sysmon Event ID 1: cmd.exe with ParentImage=WmiPrvSE.exe (confirming WMI execution path). PowerShell ScriptBlock Log Event ID 4104 with full Invoke-WmiMethod call. Sysmon Event ID 3: network connection to 127.0.0.1 on port 135 (DCOM).
- Test 3WMI System Enumeration and Discovery
Expected signal: Four separate Sysmon Event ID 1 entries for wmic.exe, each with distinct CommandLine arguments (os get, process list, service where, nicconfig get). Security Event ID 4688 equivalents if audit policy enabled. No network events expected for local-only enumeration. Each invocation generates a process creation event with the full command line.
- Test 4WMI Shadow Copy Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=wmic.exe, CommandLine containing 'shadowcopy list brief'. Security Event ID 4688 equivalent with command line. No child processes created. No file system modification. The 'shadowcopy' keyword in the CommandLine is the detection trigger.
References (12)
- https://attack.mitre.org/techniques/T1047/
- https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
- https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page
- https://techcommunity.microsoft.com/t5/windows-it-pro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/ba-p/4039242
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.mandiant.com/resources/reports
- https://github.com/nccgroup/wmi-forensics
- https://www.secureworks.com/blog/wmi-persistence
- https://www.cybereason.com/blog/wmi-lateral-movement-win32-process
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
Unlock Pro Content
Get the full detection package for T1047 including response playbook, investigation guide, and atomic red team tests.