Skip to content
Threat Feed
Subscribe

Product

Windows Management Instrumentation

3 briefs RSS
high threat

Persistence via WMI Standard Registry Provider

The rule identifies the use of Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence by detecting registry changes made by WmiPrvSe.exe in specific registry paths.

Windows Management Instrumentation persistence registry wmi windows
3r 1t
high advisory

Volume Shadow Copy Deletion via WMIC

The rule detects the use of wmic.exe for shadow copy deletion on Windows endpoints, a common tactic used in ransomware or other destructive attacks to inhibit system recovery.

Windows Management Instrumentation +3 impact windows threat-detection
3r 2t
medium advisory

WMI Incoming Lateral Movement

Detection of processes executed via Windows Management Instrumentation (WMI) on a remote host indicating potential adversary lateral movement.

HPWBEM +3 lateral-movement wmi windows
3r 2t