Skip to content
Threat Feed
Subscribe
medium advisory

Suspicious WMI Process Execution via WmiPrvSE

Detection of unauthorized or suspicious process spawning from WmiPrvSE.exe, a common technique for lateral movement, remote code execution, and persistence via Windows Management Instrumentation.

Windows Management Instrumentation (WMI) is a powerful administrative feature that can be exploited by attackers to facilitate lateral movement, execute arbitrary code, or maintain persistence on a target system. When WMI is used to launch processes remotely, the WmiPrvSE.exe (WMI Provider Host) process spawns the child process associated with the attacker's command. This detection analytic focuses on identifying these child processes created by WmiPrvSE.exe, which often indicates malicious use of WMI rather than legitimate administrative tasks. By monitoring EDR telemetry for specific process and parent-process relationships, detection engineers can uncover unauthorized command execution, such as the deployment of beacons, discovery tools, or malicious scripts. Defenders should baseline their environment for legitimate WMI usage to reduce noise from administrative automation.

Impact

Successful exploitation of WMI for process execution can lead to full system compromise, including unauthorized command execution, lateral movement across the internal network, and the establishment of long-term persistence mechanisms. This activity is frequently observed in post-exploitation phases to escalate privileges or exfiltrate data from affected Windows hosts.

Recommendation

  • Deploy the provided Sigma rule to your SIEM to monitor for suspicious child processes spawned by WmiPrvSE.exe.
  • Integrate EDR process telemetry (e.g., Sysmon Event ID 1) with the SIEM to ensure full command-line visibility for WMI-related activity.
  • Baseline legitimate administrative scripts that utilize WMI to create a filter list, reducing the volume of false positives.
  • Investigate occurrences of wmic.exe or powershell.exe spawned by WmiPrvSE.exe, as these are high-signal indicators of potential lateral movement.

Immediate actions

Deploy Sigma rule for WMI process creation monitoring.

Detection Engineering 48h

Threat Hunt

Identify long-running or anomalous child processes spawned by WmiPrvSE.exe.

T1047 medium medium confidence hunt now

Data: Process creation logs with ParentImage

Detection coverage 1

Detect Suspicious WMI Process Execution

medium

Detects processes spawned by WmiPrvSE.exe, which is indicative of WMI-based remote execution or lateral movement.

sigma tactics: execution, lateral_movement, persistence techniques: T1047 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →