Known false positives
- False positives are expected (e.g. in environments where WinRM is used legitimately)
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: WmiPrvSE Spawned A Process
id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
related:
- id: 8a582fe2-0882-4b89-a82a-da6b2dc32937
type: similar
- id: 692f0bec-83ba-4d04-af7e-e884a96059b6
type: similar
status: stable
description: Detects WmiPrvSE spawning a process
references:
- https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-15
modified: 2023-03-23
tags:
- attack.execution
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\WmiPrvSe.exe'
filter_logonid:
LogonId:
- '0x3e7' # LUID 999 for SYSTEM
- 'null' # too many false positives
filter_system_user:
User|contains: # covers many language settings
- 'AUTHORI'
- 'AUTORI'
filter_wmiprvse:
Image|endswith: '\WmiPrvSE.exe'
filter_werfault:
Image|endswith: '\WerFault.exe'
filter_null: # some backends need the null value in a separate expression
LogonId: null
condition: selection and not 1 of filter_*
falsepositives:
- False positives are expected (e.g. in environments where WinRM is used legitimately)
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
ParentImage|endswith: '\WmiPrvSe.exe'
Stage 2: not filter_*
filter_logonid:
LogonId:
- '0x3e7'
- 'null'
filter_system_user:
User|contains:
- 'AUTHORI'
- 'AUTORI'
filter_wmiprvse:
Image|endswith: '\WmiPrvSE.exe'
filter_werfault:
Image|endswith: '\WerFault.exe'
filter_null:
LogonId: null
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \WerFault.exe | excludes:Image field:"Image" value:"\WerFault.exe" |
Image | ends_with | \WmiPrvSE.exe | excludes:Image field:"Image" value:"\WmiPrvSE.exe" |
LogonId | eq | 0x3e7 | excludes:LogonId field:"LogonId" value:"0x3e7" |
LogonId | eq | null | excludes:LogonId field:"LogonId" value:"null" |
LogonId | is_null | excludes:LogonId | |
User | match | AUTHORI | excludes:User field:"User" value:"AUTHORI" |
User | match | AUTORI | excludes:User field:"User" value:"AUTORI" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\WmiPrvSe.exe" |