Windows Management Instrumentation T1047

Events covered

22 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 140 rules share fields, values, and exclusions.

Fields filtered most (64 distinct)

These fields appear most often in rule filters.

Top indicator values (1024 distinct)

These values appear most often in rule predicates.

Exclusions (588 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Sigma 55 rules

• Application Removed Via Wmic.EXE
• Application Termination Attempt via Wmic.EXE
• Blue Mockingbird
• Blue Mockingbird - Registry
• Computer System Reconnaissance Via Wmic.EXE
• HackTool - CrackMapExec Execution
• HackTool - CrackMapExec Execution Patterns
• HackTool - Potential Impacket Lateral Movement Activity
• Hardware Model Reconnaissance Via Wmic.EXE
• HTML Help HH.EXE Suspicious Child Process
• Impacket WMIexec process execution
• MITRE BZAR Indicators for Execution
• Password Set to Never Expire via WMI
• Potential Maze Ransomware Activity
• Potential Process Reconnaissance via Wmic.EXE
• Potential Product Class Reconnaissance Via Wmic.EXE
• Potential Product Reconnaissance Via Wmic.EXE
• Potential Remote SquiblyTwo Technique Execution
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
• Potential Windows Defender Tampering Via Wmic.EXE
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
• Process Creation Attempt via Wmic.EXE
• PSExec and WMI Process Creations Block
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
• Registry Enumeration via WMI Stdregprov
• Registry Manipulation via WMI Stdregprov
• Remote DCOM/WMI Lateral Movement
• Script Event Consumer Spawning Process
• Service Reconnaissance Via Wmic.EXE
• Service Started/Stopped Via Wmic.EXE
• Service Startup Type Change Via Wmic.EXE
• Successful Account Login Via WMI
• Suspicious Autorun Registry Modified via WMI
• Suspicious Encoded Scripts in a WMI Consumer
• Suspicious HH.EXE Execution
• Suspicious Microsoft Office Child Process
• Suspicious Process Created Via Wmic.EXE
• Suspicious WMIC Execution Via Office Process
• Suspicious WmiPrvSE Child Process
• System Disk And Volume Reconnaissance Via Wmic.EXE
• T1047 Wmiprvse Wbemcomn DLL Hijack
• UNC2452 PowerShell Pattern
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE
• WMI Event Consumer Created Named Pipe
• WMI module loaded by suspicious process
• WMI Module Loaded By Uncommon Process
• WMI spwaning PowerShell process - WMImplant
• WMIC Remote Command Execution
• WMIC Unquoted Services Path Lookup - PowerShell
• Wmiexec Default Output File
• WMImplant Hack Tool
• WmiPrvSE Spawned A Process
• Wmiprvse Wbemcomn DLL Hijack
• Wmiprvse Wbemcomn DLL Hijack - File
• XSL Script Execution Via WMIC.EXE

Elastic 44 rules

• Delayed Execution via Ping
• Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM
• Enumeration Command Spawned via WMIPrvSE
• Execution via a Suspicious WMI Client
• Execution via WMI ActiveScript Event Consumer
• Execution via WMI CommandLine Event Consumer
• Execution via WMI followed by Network Connection
• Inhibit System Recovery via Microsoft Office Process
• Inhibit System Recovery via Obfuscated Commands
• Inhibit System Recovery via Windows Command Shell
• Microsoft Build Engine Started by a System Process
• Microsoft Office File Execution via WMI
• Mofcomp Activity
• Persistence via WMI Event Subscription
• Persistence via WMI Standard Registry Provider
• Process Creation from an Unusual WMI Client
• Registry Modification via WMI StdRegProv
• Security Software Discovery using WMIC
• Service Control Spawned via Script Interpreter
• Shadow Copy Deletion via Windows Management Instrumentation
• Suspicious .NET Code Compilation
• Suspicious Cmd Execution via WMI
• Suspicious Cmd Execution via WMI
• Suspicious Execution from a Mounted Device
• Suspicious Execution via Windows Management Instrumentation
• Suspicious Managed Code Hosting Process
• Suspicious Registry Modification via WMI
• Suspicious ScreenConnect Client Child Process
• Suspicious WMI Enumeration via Windows Scripts
• Suspicious WMI Image Load from MS Office
• Suspicious WMI Library Load
• Suspicious WMIC XSL Script Execution
• Suspicious WMIC XSL Script Execution
• Unusual Registry Modification via WMI
• Volume Shadow Copy Deletion via PowerShell
• Volume Shadow Copy Deletion via WMIC
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Defender Exclusions via WMI
• Windows Script Interpreter Executing Process via WMI
• Windows System Information Discovery
• WMI Image Load via Microsoft Office
• WMI Incoming Lateral Movement
• WMI WBEMTEST Utility Execution
• WMIC Remote Command

Splunk 38 rules

• Impacket Lateral Movement Commandline Parameters
• Impacket Lateral Movement smbexec CommandLine Parameters
• Impacket Lateral Movement WMIExec Commandline Parameters
• Impacket_Empire's WMIExec (Windows Event Log)
• Possible Lateral Movement PowerShell Spawn
• PowerShell Invoke CIMMethod CIMSession
• PowerShell Invoke WmiExec Usage
• Process Execution via WMI
• Remote Process Instantiation via WMI
• Remote Process Instantiation via WMI and PowerShell
• Remote Process Instantiation via WMI and PowerShell Script Block
• Remote WMI Command Attempt
• Remote WMIC Query (PowerShell)
• Remote WMIC Query (Sysmon)
• Remote WMIC Query (Windows Event Log)
• Script Execution via WMI
• System Enumeration with WMIC (Sysmon)
• System Enumeration with WMIC (Windows Event Log)
• Windows WinRAR Launched Outside Default Installation Directory
• Windows WMI Impersonate Token
• Windows WMI Process And Service List
• Windows WMI Process Call Create
• Windows WMI Reconnaissance Class Query
• WinRM Tools (PowerShell)
• WinRM Tools (Sysmon)
• WinRM Tools (Windows Event Log)
• WMI Permanent Event Subscription
• WMI subscription execution (Sysmon)
• WMI subscription execution (Windows Event Log)
• WMI Temporary Event Subscription
• WMIC Explicit Credentials (Sysmon)
• WMIC Explicit Credentials (Windows Event Log)
• WMIC Host Reconniassance (PowerShell)
• WMIC Host Reconniassance (Sysmon)
• WMIC Host Reconniassance (Windows Event Log)
• Wmiprvse LOLBAS Execution Process Spawn
• WmiPrvSE Suspicious Child Process (Sysmon)
• WmiPrvSE Suspicious Child Process (Windows Event Log)

Kusto 2 rules

• Powershell Empire Cmdlets Executed in Command Line
• WMI Spawning Suspicious Child Process (Living off the Land)

YARA-L 1 rule

• Impacket WMIExec CISA Report