Windows Management Instrumentation detection rulesT1047

Detects specific process characteristics of Maze ransomware word document droppers

windows · process_creation

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

windows · process_creation

Detects the creation of the default output filename used by the wmiexec tool

windows · file_event

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

windows · file_event

Attempts to detect system changes made by Blue Mockingbird

windows · process_creation

Attempts to detect system changes made by Blue Mockingbird

windows · registry_set

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows · process_creation

Detects various execution patterns of the CrackMapExec pentesting framework

windows · process_creation

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

windows · process_creation

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

windows · process_creation

Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

windows · process_creation

Detects blocking of process creations originating from PSExec and WMI commands

windows

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

rpc_firewall · application

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

windows · process_creation

Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

windows · process_creation

Detects suspicious encoded payloads in WMI Event Consumers

windows · wmi_event

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

windows · process_creation

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

windows · process_creation

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

windows · process_creation

Detects suspicious and uncommon child processes of WmiPrvSE

windows · process_creation

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.

windows

Detects parameters used by WMImplant

windows · ps_script

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

windows · image_load

Detects the removal or uninstallation of an application via "Wmic.EXE".

windows · process_creation

Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

windows · process_creation

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

windows · process_creation

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

windows · process_creation

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

zeek

Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.

windows · process_creation

Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts.

windows · process_creation

Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products. Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms. This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.

windows · process_creation

Detects the execution of WMIC in order to get a list of firewall and antivirus products

windows · process_creation

Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

windows · process_creation

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

windows · process_creation

Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

windows · process_creation

Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.

windows · process_creation

Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands.

windows · process_creation

Detects the usage of wmic.exe to modify Windows registry via the WMI StdRegProv class write methods (CreateKey, DeleteKey, SetStringValue, etc.). This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe. Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.

windows · process_creation

An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

windows · process_creation

Detects usage of wmic to start or stop a service

windows · process_creation

Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.

windows · process_creation

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the 'wmic' command-line utility and has been observed being used by threat actors such as Volt Typhoon.

windows · process_creation

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

windows · process_creation

Detects the WMI Event Consumer service scrcons.exe creating a named pipe

windows · pipe_created

Detects the execution of WMIC to query information on a remote system

windows · process_creation

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

windows · ps_script

Detects WmiPrvSE spawning a process

windows · process_creation

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

windows · process_creation

Detects successful logon attempts performed with WMI

windows

Detects WMI modules being loaded by an uncommon process

windows · image_load