Detection rules › Splunk
WmiPrvSE Suspicious Child Process (Windows Event Log)
Windows Management Instrumentation Provider Service (WmiPrvSE.exe) is a Windows component used for system management, monitoring, and reporting. While it is legitimately used by system administrators, its system privileges make it an attractive target for abuse by threat actors. This use case detects unusual child processes of WmiPrvSe.exe. It specifically looks for instances where known scripting or executable processes are spawned by WmiPrvSe.exe. The rule excludes certain system processes like 'werfault' and 'wmiprvse' and specific user accounts to reduce false positives, focusing on patterns that are often associated with security threats or attacks
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1047 Windows Management Instrumentation |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '25922.47940'
title: WmiPrvSE Suspicious Child Process
description: Windows Management Instrumentation Provider Service (WmiPrvSE.exe) is
a Windows component used for system management, monitoring, and reporting. While
it is legitimately used by system administrators, its system privileges make it
an attractive target for abuse by threat actors. This use case detects unusual child
processes of WmiPrvSe.exe. It specifically looks for instances where known scripting
or executable processes are spawned by WmiPrvSe.exe. The rule excludes certain system
processes like 'werfault' and 'wmiprvse' and specific user accounts to reduce false
positives, focusing on patterns that are often associated with security threats
or attacks. Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(wmiprvse) OR "wmiprvse.exe") (TERM(certutil)
OR TERM(cscript) OR TERM(mshta) OR TERM(msiexec) OR TERM(regsvr32) OR TERM(rundll32)
OR TERM(verclsid) OR TERM(wscript) OR "certutil" OR "cscript" OR "mshta" OR "msiexec"
OR "regsvr32" OR "rundll32" OR "verclsid" OR "wscript") | where match(parent_process_path,
"(?i)(\x5cwbem\x5cwmiprvse\.exe)") and (match(process_name, "(?i)(certutil|cscript|mshta|msiexec|regsvr32|rundll32|verclsid|wscript)\.exe")
or match(process_name, "(?i)cmd\.exe") and match(process, "(?i)(cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript)"))
and not match(process_name, "(?i)(werfault|wmiprvse)\.exe") and not match(user,
"AUTHORI|AUTORI") | table _time, host, user, process, process_*, parent_process_*
| bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:windows management instrumentation
technique_id:
- T1047
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
- https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(wmiprvse) OR "wmiprvse.exe") (TERM(certutil) OR TERM(cscript) OR TERM(mshta) OR TERM(msiexec) OR TERM(regsvr32) OR TERM(rundll32) OR TERM(verclsid) OR TERM(wscript) OR "certutil" OR "cscript" OR "mshta" OR "msiexec" OR "regsvr32" OR "rundll32" OR "verclsid" OR "wscript")
Stage 2: where
| where match(parent_process_path, "(?i)(\x5cwbem\x5cwmiprvse\.exe)") and (match(process_name, "(?i)(certutil|cscript|mshta|msiexec|regsvr32|rundll32|verclsid|wscript)\.exe") or match(process_name, "(?i)cmd\.exe") and match(process, "(?i)(cscript|mshta|powershell|pwsh|regsvr32|rundll32|wscript)")) and not match(process_name, "(?i)(werfault|wmiprvse)\.exe") and not match(user, "AUTHORI|AUTORI")
Stage 3: table
| table _time, host, user, process, process_*, parent_process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
process_name | match | "(?i)(werfault|wmiprvse)\.exe" |
user | match | "AUTHORI|AUTORI" |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
parent_process_path | match |
|
process | match |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | wmiprvse |
| 1 | "wmiprvse.exe" |
| 1 | TERM |
| 1 | certutil |
| 1 | TERM |
| 1 | cscript |
| 1 | TERM |
| 1 | mshta |
| 1 | TERM |
| 1 | msiexec |
| 1 | TERM |
| 1 | regsvr32 |
| 1 | TERM |
| 1 | rundll32 |
| 1 | TERM |
| 1 | verclsid |
| 1 | TERM |
| 1 | wscript |
| 1 | "certutil" |
| 1 | "cscript" |
| 1 | "mshta" |
| 1 | "msiexec" |
| 1 | "regsvr32" |
| 1 | "rundll32" |
| 1 | "verclsid" |
| 1 | "wscript" |