Suspicious WmiPrvSE Spawned A Process (via process_creation)

title: Suspicious WmiPrvSE Spawned A Process (via process_creation)
id: 3c70cf32-29f9-5c84-ae55-4ce83419252c
status: stable
description: This rule detects WmiPrvSE spawning a process
references:
    - https://attack.mitre.org/techniques/T1047/
    - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
author: Huntrule Team
date: 2026-04-25
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\WmiPrvSe.exe'
    filter_logonid:
        LogonId:
            - '0x3e7'
            - 'null'
    filter_system_user:
        User|contains:
            - 'AUTHORI'
            - 'AUTORI'
    filter_wmiprvse:
        Image|endswith: '\WmiPrvSE.exe'
    filter_werfault:
        Image|endswith: '\WerFault.exe'
    filter_null:
        LogonId:
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: medium