{"id":"T1047","name":"Windows Management Instrumentation","url":"https://attack.mitre.org/techniques/T1047","tactics":["execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0364","stix_id":"x-mitre-detection-strategy--8374a5e5-6d9f-4896-9546-a4d998188ac5","name":"Behavioral Detection Strategy for WMI Execution Abuse on Windows","url":"https://attack.mitre.org/detectionstrategies/DET0364","analytics":[{"id":"AN1031","stix_id":"x-mitre-analytic--17687fa0-bfbf-4ff2-9eb0-520538e6af31","name":"Analytic 1031","description":"Detects adversarial abuse of WMI to execute local or remote commands via WMIC, PowerShell, or COM API through a multi-event chain: process creation, command execution, and corresponding network connection if remote.","url":"https://attack.mitre.org/detectionstrategies/DET0364#AN1031","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:WMI","channel":"EventCode=5857, 5858, 5860, 5861","data_component":"DC0008","data_component_name":"WMI Creation","log_source_slug":"wineventlog-wmi"}],"mutable_elements":[{"field":"WMIQueryScope","description":"Restrict detection scope to suspicious WMI namespaces like `\\root\\cimv2`, `\\root\\subscription`."},{"field":"TimeWindow","description":"Set maximum allowable time window to correlate WMI process creation and remote connections."},{"field":"UserContext","description":"Tune based on interactive vs. system-level execution (e.g., via SYSTEM or low-privileged users)."},{"field":"RemoteDestinationThreshold","description":"Number of unique remote hosts contacted using WMI within a time window."},{"field":"SuspiciousCommandPatterns","description":"Regex patterns to identify adversary-like usage (e.g., `wmic process call`, `powershell Invoke-WmiMethod`)."}],"live":true,"detection_strategies":["DET0364"],"techniques":["T1047"]}],"live":true,"version":"1.0","techniques":["T1047"]}],"sigma_rules":[{"id":"058f4380-962d-40a5-afce-50207d36d7e2","title":"HackTool - CrackMapExec Execution Patterns","author":"Thomas Patzke","status":"stable","level":"high","date":"2020-05-22","modified":"2023-11-06","description":"Detects various execution patterns of the CrackMapExec pentesting framework","references":["https://github.com/byt3bl33d3r/CrackMapExec"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.s0106"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml","techniques":["T1047","T1053","T1059.003","T1059.001"],"cves":[]},{"id":"05c36dd6-79d6-4a9a-97da-3db20298ab2d","title":"XSL Script Execution Via WMIC.EXE","author":"Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2019-10-21","modified":"2026-01-24","description":"Detects the execution of WMIC with the \"format\" flag to potentially load local XSL files.\nAdversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.\nExtensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"09658312-bc27-4a3b-91c5-e49ab9046d1b","title":"WMIC Unquoted Services Path Lookup - PowerShell","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2022-11-25","description":"Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts","references":["https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py","https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1","https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml","techniques":["T1047"],"cves":[]},{"id":"0b7163dc-7eee-4960-af17-c0cd517f92da","title":"Service Started/Stopped Via Wmic.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2023-02-14","description":"Detects usage of wmic to start or stop a service","references":["https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml","techniques":["T1047"],"cves":[]},{"id":"10c14723-61c7-4c75-92ca-9af245723ad2","title":"HackTool - Potential Impacket Lateral Movement Activity","author":"Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch","status":"stable","level":"high","date":"2019-09-03","modified":"2023-02-21","description":"Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework","references":["https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py","https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py","https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py","https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py","https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml","techniques":["T1047","T1021.003"],"cves":[]},{"id":"15434e33-5027-4914-88d5-3d4145ec25a9","title":"Potential Product Reconnaissance Via Wmic.EXE","author":"Nasreddine Bencherchali","status":"test","level":"medium","date":"2023-02-14","modified":"2025-12-15","description":"Detects the execution of WMIC in order to get a list of firewall and antivirus products","references":["https://thedfirreport.com/2023/03/06/2022-year-in-review/","https://www.yeahhub.com/list-installed-programs-version-path-windows/","https://learn.microsoft.com/en-us/answers/questions/253555/software-list-inventory-wmic-product"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_product.yml","techniques":["T1047"],"cves":[]},{"id":"221b251a-357a-49a9-920a-271802777cc0","title":"Potential Process Reconnaissance via Wmic.EXE","author":"frack113","status":"test","level":"medium","date":"2022-01-01","modified":"2025-12-15","description":"Detects the execution of \"wmic\" with the \"process\" flag, which might indicate an attempt to perform reconnaissance on running processes.\nAdversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.discovery","attack.t1057"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_process.yml","techniques":["T1047","T1057"],"cves":[]},{"id":"29fd07fc-9cfd-4331-b7fd-cc18dfa21052","title":"Potential Maze Ransomware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-08","modified":"2023-02-13","description":"Detects specific process characteristics of Maze ransomware word document droppers","references":["https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html","https://app.any.run/tasks/51e7185c-52d7-4efb-ac0d-e86340053473/","https://app.any.run/tasks/65a79440-373a-4725-8d74-77db9f2abda4/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1204.002","attack.t1047","attack.impact","attack.t1490","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Maze/proc_creation_win_malware_maze_ransomware.yml","techniques":["T1204.002","T1047","T1490"],"cves":[]},{"id":"3c89a1e8-0fba-449e-8f1b-8409d6267ec8","title":"Suspicious Process Created Via Wmic.EXE","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-10-12","modified":"2023-02-14","description":"Detects WMIC executing \"process call create\" with suspicious calls to processes such as \"rundll32\", \"regsrv32\", etc.","references":["https://thedfirreport.com/2020/10/08/ryuks-return/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml","techniques":["T1047"],"cves":[]},{"id":"3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d","title":"Hardware Model Reconnaissance Via Wmic.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":null,"description":"Detects the execution of WMIC with the \"csproduct\" which is used to obtain information such as hardware models and vendor information","references":["https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/","https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","car.2016-03-002"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml","techniques":["T1047"],"cves":[]},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-03-08","description":"This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.","references":["https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local","https://www.mandiant.com/resources/telegram-malware-iranian-espionage","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.discovery","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.t1110","attack.t1201"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","techniques":["T1047","T1053","T1059.003","T1059.001","T1110","T1201"],"cves":[]},{"id":"438025f9-5856-4663-83f7-52f878a70a50","title":"Suspicious Microsoft Office Child Process","author":"Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io","status":"test","level":"high","date":"2018-04-06","modified":"2023-04-24","description":"Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)","references":["https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100","https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html","https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e","https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml","https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml","https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A","https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set","https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml","https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html","https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1047","attack.t1204.002","attack.t1218.010"],"path":"rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml","techniques":["T1047","T1204.002","T1218.010"],"cves":[]},{"id":"493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb","title":"WMI Event Consumer Created Named Pipe","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2021-09-01","modified":"2023-11-30","description":"Detects the WMI Event Consumer service scrcons.exe creating a named pipe","references":["https://github.com/RiccardoAncarani/LiquidSnake"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.t1047","attack.execution"],"path":"rules/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml","techniques":["T1047"],"cves":[]},{"id":"49d9671b-0a0a-4c09-8280-d215bfd30662","title":"Application Termination Attempt via Wmic.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-11","modified":null,"description":"Detects an attempt to terminate a process via \"wmic\" with the \"call terminate\" flag. Adversaries may\nuse wmic to terminate security products or other applications on the compromised host. This event is\ntriggered on on attempt and process creation can be either successful or unsuccessful.\n","references":["https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/","https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_terminate_application.yml","techniques":["T1047"],"cves":[]},{"id":"4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d","title":"RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class","author":"Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-11-15","modified":null,"description":"Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell.\nIn PowerShell one-liner commands, the \"SetAllowTSConnections\" method of the \"Win32_TerminalServiceSetting\" class may be used to enable or disable RDP.\nIn WMIC, the \"rdtoggle\" alias or \"Win32_TerminalServiceSetting\" class may be used for the same purpose.\n","references":["https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html","https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall","https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.t1021.001","attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml","techniques":["T1021.001","T1047"],"cves":[]},{"id":"51cbac1e-eee3-4a90-b1b7-358efb81fa0a","title":"Potential Windows Defender Tampering Via Wmic.EXE","author":"frack113","status":"test","level":"high","date":"2022-12-11","modified":"2023-02-14","description":"Detects potential tampering with Windows Defender settings such as adding exclusion using wmic","references":["https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md","https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/","https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1047","attack.t1685"],"path":"rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml","techniques":["T1047","T1685"],"cves":[]},{"id":"526be59f-a573-4eea-b5f7-f0973207634d","title":"Process Creation Attempt via Wmic.EXE","author":"Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community","status":"test","level":"medium","date":"2019-01-16","modified":"2023-02-14","description":"Detects the attempt to create a process via \"wmic\" with the \"process call create\" flag, which might\nindicate an attempt to execute a malicious process on the compromised host. Adversaries may use\nwmic to execute a process on the compromised host as part of their attack. This event is triggered on\non attempt and process creation can be either successful or unsuccessful.\n","references":["https://www.sans.org/blog/wmic-for-incident-response/","https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","car.2016-03-002"],"path":"rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml","techniques":["T1047"],"cves":[]},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious child process of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"5af54681-df95-4c26-854f-2565e13cfab0","title":"Successful Account Login Via WMI","author":"Thomas Patzke","status":"stable","level":"low","date":"2019-12-04","modified":"2024-01-17","description":"Detects successful logon attempts performed with WMI","references":["Internal Research"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/builtin/security/account_management/win_security_susp_wmi_login.yml","techniques":["T1047"],"cves":[]},{"id":"614a7e17-5643-4d89-b6fe-f9df1a79641c","title":"Wmiprvse Wbemcomn DLL Hijack - File","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"critical","date":"2020-10-12","modified":"2022-12-02","description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml","techniques":["T1047","T1021.002"],"cves":[]},{"id":"671bb7e3-a020-4824-a00e-2ee5b55f385e","title":"WMI Module Loaded By Uncommon Process","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"low","date":"2019-08-10","modified":"2026-06-29","description":"Detects WMI modules being loaded by an uncommon process","references":["https://threathunterplaybook.com/hunts/windows/190811-WMIModuleLoad/notebook.html"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1047","detection.threat-hunting"],"path":"rules-threat-hunting/windows/image_load/image_load_wmi_module_load_by_uncommon_process.yml","techniques":["T1047"],"cves":[]},{"id":"68050b10-e477-4377-a99b-3721b422d6ef","title":"Remote DCOM/WMI Lateral Movement","author":"Sagie Dulce, Dekel Paz","status":"test","level":"high","date":"2022-01-01","modified":null,"description":"Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.","references":["https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9","https://github.com/zeronetworks/rpcfirewall","https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/"],"logsource":{"product":"rpc_firewall","category":"application"},"tags":["attack.lateral-movement","attack.execution","attack.t1021.003","attack.t1047"],"path":"rules/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml","techniques":["T1021.003","T1047"],"cves":[]},{"id":"68bcd73b-37ef-49cb-95fc-edc809730be6","title":"Potential Unquoted Service Path Reconnaissance Via Wmic.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2023-09-11","description":"Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts","references":["https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py","https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1","https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml","techniques":["T1047"],"cves":[]},{"id":"692f0bec-83ba-4d04-af7e-e884a96059b6","title":"Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell","author":"Markus Neis @Karneades","status":"stable","level":"medium","date":"2019-04-03","modified":"2023-03-29","description":"Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.","references":["https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml","techniques":["T1047","T1059.001"],"cves":[]},{"id":"76f55eaa-d27f-4213-9d45-7b0e4b60bbae","title":"Service Reconnaissance Via Wmic.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":"2026-01-07","description":"An adversary might use WMI to check if a certain remote service is running on a remote device.\nWhen the test completes, a service information will be displayed on the screen if it exists.\nA common feedback message is that \"No instance(s) Available\" if the service queried is not running.\nA common error message is \"Node - (provided IP or default) ERROR Description =The RPC server is unavailable\" if the provided remote host is unreachable\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic","https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml","techniques":["T1047"],"cves":[]},{"id":"7707a579-e0d8-4886-a853-ce47e4575aaa","title":"Wmiprvse Wbemcomn DLL Hijack","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"high","date":"2020-10-12","modified":"2022-10-09","description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml","techniques":["T1047","T1021.002"],"cves":[]},{"id":"7773b877-5abb-4a3e-b9c9-fd0369b59b00","title":"WMIC Remote Command Execution","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":"2025-10-22","description":"Detects the execution of WMIC to query information on a remote system","references":["https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml","techniques":["T1047"],"cves":[]},{"id":"7864a175-3654-4824-9f0d-f0da18ab27c0","title":"Password Set to Never Expire via WMI","author":"Daniel Koifman (KoifSec)","status":"experimental","level":"medium","date":"2025-07-30","modified":null,"description":"Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.\n","references":["https://www.huntress.com/blog/the-unwanted-guest"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1047","attack.t1098"],"path":"rules/windows/process_creation/proc_creation_win_wmi_password_never_expire.yml","techniques":["T1047","T1098"],"cves":[]},{"id":"8028c2c3-e25a-46e3-827f-bbb5abf181d7","title":"WMImplant Hack Tool","author":"NVISO","status":"test","level":"high","date":"2020-03-26","modified":"2022-12-25","description":"Detects parameters used by WMImplant","references":["https://github.com/FortyNorthSecurity/WMImplant"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1047","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_wmimplant.yml","techniques":["T1047","T1059.001"],"cves":[]},{"id":"83844185-1c5b-45bc-bcf3-b5bf3084ca5b","title":"Suspicious Encoded Scripts in a WMI Consumer","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-09-01","modified":"2022-10-09","description":"Detects suspicious encoded payloads in WMI Event Consumers","references":["https://github.com/RiccardoAncarani/LiquidSnake"],"logsource":{"product":"windows","category":"wmi_event"},"tags":["attack.privilege-escalation","attack.execution","attack.t1047","attack.persistence","attack.t1546.003"],"path":"rules/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml","techniques":["T1047","T1546.003"],"cves":[]},{"id":"8a582fe2-0882-4b89-a82a-da6b2dc32937","title":"Suspicious WmiPrvSE Child Process","author":"Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2023-11-10","description":"Detects suspicious and uncommon child processes of WmiPrvSE","references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml","https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/","https://twitter.com/ForensicITGuy/status/1334734244120309760"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1047","attack.t1204.002","attack.t1218.010"],"path":"rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml","techniques":["T1047","T1204.002","T1218.010"],"cves":[]},{"id":"8d5aca11-22b3-4f22-b7ba-90e60533e1fb","title":"Wmiexec Default Output File","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"critical","date":"2022-06-02","modified":"2023-03-08","description":"Detects the creation of the default output filename used by the wmiexec tool","references":["https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/","https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.lateral-movement","attack.execution","attack.t1047"],"path":"rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml","techniques":["T1047"],"cves":[]},{"id":"8d63dadf-b91b-4187-87b6-34a1114577ea","title":"Potential Remote SquiblyTwo Technique Execution","author":"Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2026-01-24","description":"Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)\nto execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process\nmalicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.\nThe attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it\nwith full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common\nLOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.\n","references":["https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html","https://twitter.com/mattifestation/status/986280382042595328","https://atomicredteam.io/defense-evasion/T1220/","https://lolbas-project.github.io/lolbas/Binaries/Wmic/","https://x.com/byrne_emmy12099/status/1932346420226658668"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"path":"rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","techniques":["T1047","T1220","T1059.005","T1059.007"],"cves":[]},{"id":"92b0b372-a939-44ed-a11b-5136cf680e27","title":"Blue Mockingbird - Registry","author":"Trent Liffick (@tliffick)","status":"test","level":"high","date":"2020-05-14","modified":"2023-08-17","description":"Attempts to detect system changes made by Blue Mockingbird","references":["https://redcanary.com/blog/blue-mockingbird-cryptominer/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.persistence","attack.defense-impairment","attack.t1112","attack.t1047","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Blue-Mockingbird/registry_set_mal_blue_mockingbird.yml","techniques":["T1112","T1047"],"cves":[]},{"id":"97b9ce1e-c5ab-11ea-87d0-0242ac130003","title":"PSExec and WMI Process Creations Block","author":"Bhabesh Raj","status":"test","level":"high","date":"2020-07-14","modified":"2022-12-25","description":"Detects blocking of process creations originating from PSExec and WMI commands","references":["https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands","https://twitter.com/duff22b/status/1280166329660497920"],"logsource":{"product":"windows","service":"windefend"},"tags":["attack.execution","attack.lateral-movement","attack.t1047","attack.t1569.002"],"path":"rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml","techniques":["T1047","T1569.002"],"cves":[]},{"id":"9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f","title":"Computer System Reconnaissance Via Wmic.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-09-08","modified":"2023-02-14","description":"Detects execution of wmic utility with the \"computersystem\" flag in order to obtain information about the machine such as the domain, username, model, etc.","references":["https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml","techniques":["T1047"],"cves":[]},{"id":"a0e417e2-2fa1-40da-b6d2-e094cd5e1191","title":"Registry Enumeration via WMI Stdregprov","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-07-30","modified":"2026-06-19","description":"Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.).\nWhile registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software.\nThe use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.\n","references":["https://trustedsec.com/blog/command-line-underdog-wmic-in-action","https://trustedsec.com/blog/wmi-for-script-kiddies","https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.discovery","attack.t1012"],"path":"rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_enumeration.yml","techniques":["T1047","T1012"],"cves":[]},{"id":"b53317a0-8acf-4fd1-8de8-a5401e776b96","title":"Application Removed Via Wmic.EXE","author":"frack113","status":"test","level":"medium","date":"2022-01-28","modified":"2024-07-02","description":"Detects the removal or uninstallation of an application via \"Wmic.EXE\".","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_uninstall_application.yml","techniques":["T1047"],"cves":[]},{"id":"b640c0b8-87f8-4daa-aef8-95a24261dd1d","title":"MITRE BZAR Indicators for Execution","author":"@neu5ron, SOC Prime","status":"test","level":"medium","date":"2020-03-19","modified":"2021-11-27","description":"Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE","references":["https://github.com/mitre-attack/bzar#indicators-for-attck-execution"],"logsource":{"product":"zeek","service":"dce_rpc"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1047","attack.t1053.002","attack.t1569.002"],"path":"rules/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml","techniques":["T1047","T1053.002","T1569.002"],"cves":[]},{"id":"b7155193-8a81-4d8f-805d-88de864ca50c","title":"UNC2452 PowerShell Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-01-20","modified":"2022-10-09","description":"Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports","references":["https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware","https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.t1047","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml","techniques":["T1059.001","T1047"],"cves":[]},{"id":"c0514f28-fdae-42df-b886-06e2b2bc5b37","title":"Service Startup Type Change Via Wmic.EXE","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2026-04-27","modified":null,"description":"Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.\n","references":["https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1047","attack.t1685"],"path":"rules/windows/process_creation/proc_creation_win_wmic_service_startup_change.yml","techniques":["T1047","T1685"],"cves":[]},{"id":"c3198a27-23a0-4c2c-af19-e5328d49680e","title":"Blue Mockingbird","author":"Trent Liffick (@tliffick)","status":"test","level":"high","date":"2020-05-14","modified":"2022-10-09","description":"Attempts to detect system changes made by Blue Mockingbird","references":["https://redcanary.com/blog/blue-mockingbird-cryptominer/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.defense-impairment","attack.t1112","attack.t1047","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml","techniques":["T1112","T1047"],"cves":[]},{"id":"c453ab7a-1f5c-4716-a3b4-dea8135fb43a","title":"Registry Manipulation via WMI Stdregprov","author":"Daniel Koifman (KoifSec)","status":"experimental","level":"medium","date":"2025-07-30","modified":"2026-06-19","description":"Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.).\nThis behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.\nAttackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.\n","references":["https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again","https://trustedsec.com/blog/command-line-underdog-wmic-in-action","https://trustedsec.com/blog/wmi-for-script-kiddies","https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.persistence","attack.defense-impairment","attack.t1112"],"path":"rules/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml","techniques":["T1047","T1112"],"cves":[]},{"id":"c79da740-5030-45ec-a2e0-479e824a562c","title":"System Disk And Volume Reconnaissance Via Wmic.EXE","author":"Stephen Lincoln '@slincoln-aiq' (AttackIQ)","status":"test","level":"medium","date":"2024-02-02","modified":"2025-10-20","description":"An adversary might use WMI to discover information about the system, such as the volume name, size,\nfree space, and other disk information. This can be done using the 'wmic' command-line utility and has been\nobserved being used by threat actors such as Volt Typhoon.\n","references":["https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1047","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml","techniques":["T1047","T1082"],"cves":[]},{"id":"c80e66d8-1780-48a9-b412-46663fd21ac0","title":"Suspicious Autorun Registry Modified via WMI","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-02-17","modified":null,"description":"Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.\n","references":["Internal Research","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1547.001","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_autorun_registry_modified_via_wmic.yml","techniques":["T1547.001","T1047"],"cves":[]},{"id":"d21374ff-f574-44a7-9998-4a8c8bf33d7d","title":"WmiPrvSE Spawned A Process","author":"Roberto Rodriguez @Cyb3rWard0g","status":"stable","level":"medium","date":"2019-08-15","modified":"2023-03-23","description":"Detects WmiPrvSE spawning a process","references":["https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml","techniques":["T1047"],"cves":[]},{"id":"dfd2fcb7-8bd5-4daa-b132-5adb61d6ad45","title":"Windows Hotfix Updates Reconnaissance Via Wmic.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2023-02-14","description":"Detects the execution of wmic with the \"qfe\" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts","references":["https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat","https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml","techniques":["T1047"],"cves":[]},{"id":"e1693bc8-7168-4eab-8718-cdcaa68a1738","title":"Suspicious WMIC Execution Via Office Process","author":"Vadim Khrykov, Cyb3rEng","status":"test","level":"high","date":"2021-08-23","modified":"2023-02-14","description":"Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).","references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1204.002","attack.t1047","attack.t1218.010","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml","techniques":["T1204.002","T1047","T1218.010"],"cves":[]},{"id":"e568650b-5dcd-4658-8f34-ded0b1e13992","title":"Potential Product Class Reconnaissance Via Wmic.EXE","author":"Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":"2025-03-17","description":"Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.\nAdversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.\nThis information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.\n","references":["https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md","https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1","https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.discovery","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml","techniques":["T1047","T1082"],"cves":[]},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","author":"Maxim Pavlunin","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious execution of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"f6c68d5f-e101-4b86-8c84-7d96851fd65c","title":"T1047 Wmiprvse Wbemcomn DLL Hijack","author":"Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)","status":"test","level":"high","date":"2020-10-12","modified":"2022-02-24","description":"Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network for a WMI DLL Hijack scenario.","references":["https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.002"],"path":"rules/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml","techniques":["T1047","T1021.002"],"cves":[]},{"id":"f6d1dd2f-b8ce-40ca-bc23-062efb686b34","title":"Script Event Consumer Spawning Process","author":"Sittikorn S","status":"test","level":"high","date":"2021-06-21","modified":"2022-07-14","description":"Detects a suspicious child process of Script Event Consumer (scrcons.exe).","references":["https://redcanary.com/blog/child-processes/","https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047"],"path":"rules/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml","techniques":["T1047"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}