Skip to content
Threat Feed

Tag

Wmi

8 briefs RSS
medium advisory

Stealthy WMI Lateral Movement via StealthyWMIExec.py

The StealthyWMIExec.py script facilitates lateral movement via WMI, potentially evading standard detection mechanisms by employing stealthy techniques.

lateral-movement wmi windows
2r 1t
medium advisory

Suspicious WMI Image Load from MS Office

Adversaries may exploit Windows Management Instrumentation (WMI) to execute code stealthily, bypassing traditional security measures by loading `wmiutils.dll` from Microsoft Office applications, potentially indicating malicious execution.

WINWORD.EXE +4 wmi image load office execution
2r 1t
medium advisory

Suspicious Enumeration Commands Spawned via WMIPrvSE

This rule detects suspicious execution of system enumeration commands by the Windows Management Instrumentation Provider Service (WMIPrvSE), indicating potential reconnaissance or malicious activity on Windows systems.

Elastic Defend +3 enumeration wmi discovery execution windows
2r 12t
medium advisory

WMI Incoming Lateral Movement

Detection of processes executed via Windows Management Instrumentation (WMI) on a remote host indicating potential adversary lateral movement.

HPWBEM +3 lateral-movement wmi windows
3r 2t
medium advisory

Windows Script Interpreter Executing Process via WMI

The rule identifies the use of Windows script interpreters (cscript.exe or wscript.exe) executing a process via Windows Management Instrumentation (WMI), which may indicate malicious activity, especially when initiated by non-system accounts.

Sysmon windows wmi script_execution initial_access execution
2r 4t
medium advisory

Persistence via WMI Event Subscription

Adversaries can leverage Windows Management Instrumentation (WMI) to establish persistence by creating event subscriptions that trigger malicious code execution when specific events occur, using tools like wmic.exe to create event consumers.

Microsoft Defender XDR +7 persistence execution windows wmi
2r 2t
medium advisory

Detect Suspicious WMI Event Subscription Creation for Persistence

This threat brief details the detection of malicious Windows Management Instrumentation (WMI) event subscriptions, a technique used by attackers for persistence and privilege escalation on Windows systems.

Elastic Defend persistence wmi windows event-subscription
2r 1t
high advisory

Suspicious PowerShell Reconnaissance via WMI Queries

Detection of suspicious PowerShell activity using Windows Management Instrumentation (WMI) to gather system information, indicative of reconnaissance efforts by adversaries potentially leading to further exploitation or lateral movement.

Splunk Enterprise +2 powershell wmi reconnaissance lateral_movement windows
2r 2t