Detection of WMI Process Creation via Command Line

Adversaries frequently leverage Windows Management Instrumentation (WMI) as a living-off-the-land technique to execute malicious payloads, bypass traditional security controls, and facilitate lateral movement. This activity, tracked as T1047, often involves the use of the wmic utility to invoke the process call create method. This method allows an attacker to spawn processes on local or remote hosts using built-in system administration tools, which can often evade signature-based detection mechanisms. Defenders should prioritize visibility into command-line arguments that correlate with these specific WMI parameters. Threat actors, including groups associated with Volt Typhoon, Qakbot, and IcedID, have been observed utilizing WMI for malicious process execution during campaigns targeting critical infrastructure and enterprise environments.

Attack Chain

1. Attacker gains initial access to a target system via phishing or exploitation of internet-facing services.
2. Attacker establishes a foothold on the compromised endpoint.
3. Attacker uses living-off-the-land binaries (LotLbins) to evade detection.
4. Attacker executes wmic.exe with process call create parameters to launch a malicious payload or script.
5. The WMI service spawns the requested process under the context of the service account.
6. The spawned process executes arbitrary commands, such as downloading additional malware, credential harvesting, or lateral movement.
7. Attacker achieves persistence or objective fulfillment while the malicious activity remains disguised as legitimate administrative traffic.

Impact

Successful exploitation of WMI for process creation can result in unauthorized code execution, privilege escalation, and long-term persistence within an environment. Threat actors like Volt Typhoon and groups deploying ransomware (e.g., Cactus) have used these techniques to maintain access across critical infrastructure and enterprise networks. Unauthorized execution can lead to full system compromise, data exfiltration, and significant operational disruption.

Recommendation

• Deploy detection logic to identify wmic command lines containing "process", "call", and "create" keywords.
• Enable Sysmon Event ID 1 (Process Creation) and Windows Security Event ID 4688 to capture full command-line strings for monitoring.
• Use the provided Sigma rule to detect suspicious WMI activity in SIEM environments.
• Baseline administrative activity involving WMI to reduce false positives generated by legitimate system maintenance tasks.