Windows Management Instrumentation T1047

Events covered

20 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 117 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (47 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (760 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (154 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 54 rules

• Application Removed Via Wmic.EXE
• Application Terminated Via Wmic.EXE
• Blue Mockingbird
• Blue Mockingbird - Registry
• Computer System Reconnaissance Via Wmic.EXE
• HackTool - CrackMapExec Execution
• HackTool - CrackMapExec Execution Patterns
• HackTool - Potential Impacket Lateral Movement Activity
• Hardware Model Reconnaissance Via Wmic.EXE
• HTML Help HH.EXE Suspicious Child Process
• Impacket WMIexec process execution
• MITRE BZAR Indicators for Execution
• New Process Created Via Wmic.EXE
• Password Set to Never Expire via WMI
• Potential Maze Ransomware Activity
• Potential Product Class Reconnaissance Via Wmic.EXE
• Potential Product Reconnaissance Via Wmic.EXE
• Potential Remote SquiblyTwo Technique Execution
• Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
• Potential Windows Defender Tampering Via Wmic.EXE
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
• Process Reconnaissance Via Wmic.EXE
• PSExec and WMI Process Creations Block
• RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
• Registry Manipulation via WMI Stdregprov
• Remote DCOM/WMI Lateral Movement
• Script Event Consumer Spawning Process
• Service Reconnaissance Via Wmic.EXE
• Service Started/Stopped Via Wmic.EXE
• Service Startup Type Change Via Wmic.EXE
• Successful Account Login Via WMI
• Suspicious Autorun Registry Modified via WMI
• Suspicious Encoded Scripts in a WMI Consumer
• Suspicious HH.EXE Execution
• Suspicious Microsoft Office Child Process
• Suspicious Process Created Via Wmic.EXE
• Suspicious WMIC Execution Via Office Process
• Suspicious WmiPrvSE Child Process
• System Disk And Volume Reconnaissance Via Wmic.EXE
• T1047 Wmiprvse Wbemcomn DLL Hijack
• UNC2452 PowerShell Pattern
• Windows Hotfix Updates Reconnaissance Via Wmic.EXE
• WMI Event Consumer Created Named Pipe
• WMI module loaded by suspicious process
• WMI Module Loaded By Uncommon Process
• WMI spwaning PowerShell process - WMImplant
• WMIC Remote Command Execution
• WMIC Unquoted Services Path Lookup - PowerShell
• Wmiexec Default Output File
• WMImplant Hack Tool
• WmiPrvSE Spawned A Process
• Wmiprvse Wbemcomn DLL Hijack
• Wmiprvse Wbemcomn DLL Hijack - File
• XSL Script Execution Via WMIC.EXE

Elastic 24 rules

• Delayed Execution via Ping
• Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM
• Enumeration Command Spawned via WMIPrvSE
• Microsoft Build Engine Started by a System Process
• Mofcomp Activity
• Persistence via WMI Event Subscription
• Persistence via WMI Standard Registry Provider
• Security Software Discovery using WMIC
• Service Control Spawned via Script Interpreter
• Suspicious .NET Code Compilation
• Suspicious Cmd Execution via WMI
• Suspicious Execution from a Mounted Device
• Suspicious Managed Code Hosting Process
• Suspicious ScreenConnect Client Child Process
• Suspicious WMI Image Load from MS Office
• Suspicious WMIC XSL Script Execution
• Volume Shadow Copy Deletion via PowerShell
• Volume Shadow Copy Deletion via WMIC
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Script Interpreter Executing Process via WMI
• Windows System Information Discovery
• WMI Incoming Lateral Movement
• WMI WBEMTEST Utility Execution
• WMIC Remote Command

Splunk 37 rules

• Impacket Lateral Movement Commandline Parameters
• Impacket Lateral Movement smbexec CommandLine Parameters
• Impacket Lateral Movement WMIExec Commandline Parameters
• Impacket_Empire's WMIExec (Windows Event Log)
• Possible Lateral Movement PowerShell Spawn
• PowerShell Invoke CIMMethod CIMSession
• PowerShell Invoke WmiExec Usage
• Process Execution via WMI
• Remote Process Instantiation via WMI
• Remote Process Instantiation via WMI and PowerShell
• Remote Process Instantiation via WMI and PowerShell Script Block
• Remote WMI Command Attempt
• Remote WMIC Query (PowerShell)
• Remote WMIC Query (Windows Event Log)
• Script Execution via WMI
• System Enumeration with WMIC (Sysmon)
• System Enumeration with WMIC (Windows Event Log)
• Windows WinRAR Launched Outside Default Installation Directory
• Windows WMI Impersonate Token
• Windows WMI Process And Service List
• Windows WMI Process Call Create
• Windows WMI Reconnaissance Class Query
• WinRM Tools (PowerShell)
• WinRM Tools (Sysmon)
• WinRM Tools (Windows Event Log)
• WMI Permanent Event Subscription
• WMI subscription execution (Sysmon)
• WMI subscription execution (Windows Event Log)
• WMI Temporary Event Subscription
• WMIC Explicit Credentials (Sysmon)
• WMIC Explicit Credentials (Windows Event Log)
• WMIC Host Reconniassance (PowerShell)
• WMIC Host Reconniassance (Sysmon)
• WMIC Host Reconniassance (Windows Event Log)
• Wmiprvse LOLBAS Execution Process Spawn
• WmiPrvSE Suspicious Child Process (Sysmon)
• WmiPrvSE Suspicious Child Process (Windows Event Log)

Kusto 1 rule

• Powershell Empire Cmdlets Executed in Command Line

YARA-L 1 rule

• Impacket WMIExec CISA Report