WMI Spawning Suspicious Child Process (Living off the Land)

Status: available
Severity: high
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

Detects WmiPrvSE.exe (the WMI Provider Host) spawning high-risk processes such as PowerShell, cmd.exe, cscript, or other LOLBins. WMI requires no external tools, generates minimal disk artifacts, and can execute code on remote systems over DCOM/RPC while bypassing many controls. Tune AllowlistedCmdPatterns for known-safe management tools such as SCCM.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation `T1059.001` Command and Scripting Interpreter: PowerShell `T1059.003` Command and Scripting Interpreter: Windows Command Shell `T1059.005` Command and Scripting Interpreter: Visual Basic
Lateral Movement	`T1021.006` Remote Services: Windows Remote Management

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: 3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f
name: WMI Spawning Suspicious Child Process (Living off the Land)
description: |
  Detects WmiPrvSE.exe (the WMI Provider Host) spawning high-risk processes
  such as PowerShell, cmd.exe, cscript, or other LOLBins.
  WMI requires no external tools, generates minimal disk artifacts, and can
  execute code on remote systems over DCOM/RPC while bypassing many controls.
  Tune AllowlistedCmdPatterns for known-safe management tools such as SCCM.
severity: High
status: Available
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Execution
  - LateralMovement
  - Persistence
relevantTechniques:
  - T1047
  - T1021.006
  - T1059.001
  - T1059.003
  - T1059.005
query: |
  let Lookback = 1h;
  let SuspiciousChildProcesses = dynamic([
    "powershell.exe", "pwsh.exe", "cmd.exe", "cscript.exe", "wscript.exe",
    "mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe",
    "rundll32.exe", "msiexec.exe", "installutil.exe", "cmstp.exe",
    "msbuild.exe", "wmic.exe", "net.exe", "net1.exe", "nltest.exe",
    "whoami.exe", "ipconfig.exe", "tasklist.exe", "schtasks.exe",
    "at.exe", "sc.exe", "reg.exe"
  ]);
  let AllowlistedCmdPatterns = dynamic([
    "ccmexec", "SMSAgent", "MOMAgent", "nessus", "qualys"
  ]);
  let NetworkIndicators = dynamic([
    "http://", "https://", "ftp://", "Net.WebClient",
    "DownloadString", "IEX", "Invoke-Expression", "/transfer", "-urlcache"
  ]);
  let CredentialIndicators = dynamic([
    "lsass", "mimikatz", "sekurlsa", "dump", "sam", "ntds"
  ]);
  let MDE_Results =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where InitiatingProcessFileName =~ "WmiPrvSE.exe"
    | where FileName in~ (SuspiciousChildProcesses)
    | where not(ProcessCommandLine has_any (AllowlistedCmdPatterns))
    | extend
        ChildProcess       = FileName,
        ChildCmdLine       = ProcessCommandLine,
        AccountName        = InitiatingProcessAccountName,
        AccountDomain      = InitiatingProcessAccountDomain,
        HostName           = DeviceName,
        EventTime          = Timestamp,
        NetworkActivity    = ProcessCommandLine has_any (NetworkIndicators),
        CredentialActivity = ProcessCommandLine has_any (CredentialIndicators)
    | project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
        ChildCmdLine, NetworkActivity, CredentialActivity;
  let SecEvent_Results =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where ParentProcessName endswith "\\WmiPrvSE.exe"
    | extend ChildProcess = tostring(split(NewProcessName, "\\")[-1])
    | where ChildProcess in~ (SuspiciousChildProcesses)
    | where not(CommandLine has_any (AllowlistedCmdPatterns))
    | extend
        ChildCmdLine       = CommandLine,
        AccountName        = SubjectUserName,
        AccountDomain      = SubjectDomainName,
        HostName           = Computer,
        EventTime          = TimeGenerated,
        NetworkActivity    = CommandLine has_any (NetworkIndicators),
        CredentialActivity = CommandLine has_any (CredentialIndicators)
    | project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
        ChildCmdLine, NetworkActivity, CredentialActivity;
  union MDE_Results, SecEvent_Results
  | extend RiskScore = iif(CredentialActivity == true, 3, iif(NetworkActivity == true, 2, 1))
  | sort by RiskScore desc, EventTime desc
entityMappings:
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: HostName
  - entityType: Account
    fieldMappings:
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountDomain
  - entityType: Process
    fieldMappings:
      - identifier: CommandLine
        columnName: ChildCmdLine
version: 1.0.5
kind: Scheduled

Stages and Predicates

Parameters

let Lookback = 1h;

Let binding: `SuspiciousChildProcesses`

let SuspiciousChildProcesses = dynamic([
  "powershell.exe", "pwsh.exe", "cmd.exe", "cscript.exe", "wscript.exe",
  "mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe",
  "rundll32.exe", "msiexec.exe", "installutil.exe", "cmstp.exe",
  "msbuild.exe", "wmic.exe", "net.exe", "net1.exe", "nltest.exe",
  "whoami.exe", "ipconfig.exe", "tasklist.exe", "schtasks.exe",
  "at.exe", "sc.exe", "reg.exe"
]);

Let binding: `AllowlistedCmdPatterns`

let AllowlistedCmdPatterns = dynamic([
  "ccmexec", "SMSAgent", "MOMAgent", "nessus", "qualys"
]);

Let binding: `NetworkIndicators`

let NetworkIndicators = dynamic([
  "http://", "https://", "ftp://", "Net.WebClient",
  "DownloadString", "IEX", "Invoke-Expression", "/transfer", "-urlcache"
]);

Let binding: `CredentialIndicators`

let CredentialIndicators = dynamic([
  "lsass", "mimikatz", "sekurlsa", "dump", "sam", "ntds"
]);

union (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: MDE_Results, SecEvent_Results

Leg 1: `MDE_Results`

Leg 2: `SecEvent_Results`

Applied to the combined result

| extend RiskScore = iif(CredentialActivity == true, 3, iif(NetworkActivity == true, 2, 1)) | sort by RiskScore desc, EventTime desc

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ProcessCommandLine`	match	`ccmexec`, `SMSAgent`, `MOMAgent`, `nessus`, `qualys`	`excludes:ProcessCommandLine`
`CommandLine`	match	`ccmexec`, `SMSAgent`, `MOMAgent`, `nessus`, `qualys`	`excludes:CommandLine`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ChildProcess`	in	`at.exe` `bitsadmin.exe` `certutil.exe` `cmd.exe` `cmstp.exe` `cscript.exe` `installutil.exe` `ipconfig.exe` `msbuild.exe` `mshta.exe` `msiexec.exe` `net.exe` `net1.exe` `nltest.exe` `powershell.exe` `pwsh.exe` `reg.exe` `regsvr32.exe` `rundll32.exe` `sc.exe` `schtasks.exe` `tasklist.exe` `whoami.exe` `wmic.exe` `wscript.exe`	`field:"ChildProcess" kind:in`
`EventID`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`FileName`	in	`at.exe` `bitsadmin.exe` `certutil.exe` corpus 2 (kusto 2) `cmd.exe` `cmstp.exe` `cscript.exe` `installutil.exe` `ipconfig.exe` `msbuild.exe` `mshta.exe` `msiexec.exe` `net.exe` `net1.exe` `nltest.exe` `powershell.exe` corpus 3 (kusto 3) `pwsh.exe` `reg.exe` `regsvr32.exe` `rundll32.exe` `sc.exe` `schtasks.exe` `tasklist.exe` `whoami.exe` `wmic.exe` `wscript.exe`	`field:"file_name" kind:in`
`InitiatingProcessFileName`	eq	`WmiPrvSE.exe` corpus 25 (elastic 19, splunk 5, kusto 1)	`field:"parent_process_name" kind:eq value:"WmiPrvSE.exe"`
`ParentProcessName`	ends_with	`\WmiPrvSE.exe` corpus 3 (sigma 2, kusto 1)	`field:"parent_process_name" kind:ends_with value:"\WmiPrvSE.exe"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`AccountDomain`	`project`
`AccountName`	`project`
`ChildCmdLine`	`project`
`ChildProcess`	`project`
`CredentialActivity`	`project`
`EventTime`	`project`
`HostName`	`project`
`NetworkActivity`	`project`
`RiskScore`	`extend`