huntrule

Suspicious Remote Process Creation and Admin Share Copy via WMIC and Xcopy

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-21
Updated
2026-09-21
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects wmic process call create and xcopy operations targeting an administrative C dollar share, the lateral movement pattern used by WorkersDevBackdoor to stage and launch payloads on remote hosts. Copying to admin shares and invoking remote process creation lets attackers spread without dropping new remote access tooling.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Suspicious Process Spawned by WmiPrvSE for Remote Execution
Malicious WMIexec Style Command Output Redirection to Local Admin Share
Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect
Suspicious WMIC Remote Process Creation for Lateral Movement
Malicious Impacket Wmiexec Remote Command Execution Pattern
Malicious Remote Process Creation via WMIC Node
Malicious Impacket WMIExec ADMIN Share Output Redirection
Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)
Malicious Remote Process Creation via wmic node call create
Suspicious Remote Process Creation and Admin Share Copy via WMIC and Xcopy
Pivot detection · T1021.002 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.