Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)

Flags ASR blocks (windefend 1121) of process creations tied to WMI (wmiprvse.exe) or PSExec (psexesvc.exe).

FreeReviewedSigma · High · v2

Product: windows
Service: windefend
Author: Bhabesh Raj (SigmaHQ), DRL 1.1
Published: 2020-07-14
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
- T1569.002Service Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies when Windows Defender Exploit Guard (Attack Surface Reduction) blocks process creation events tied to PSExec and WMI execution. Attackers commonly use PSExec or WMI to run commands remotely for lateral movement while attempting to evade standard application controls, so blocking these paths is security-relevant. It relies on windefend telemetry for EventID 1121 and matches blocked process creation activity involving the WMI provider host (wmiprvse.exe) or the PSExec service process (psexesvc.exe).

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start

Lateral Movement via WMIC Remote Process Creation

Suspicious PsExec Service Named Sliver

Malicious UAT-8302 Remote Process Execution via wmic

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Malicious Impacket Wmiexec Remote Command Execution Pattern

Malicious Shadow Copy Deletion Via WMI

PsExec Remote Service Execution on Target Host (via process_creation)

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)

Pivot detection · T1047 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-defender-exploit-guard-blocks-psexec-and-wmi-process-creations-windefend-97b9ce1e

title: Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)
id: 63ea3259-58a0-411f-920e-8ef20c41cc7b
status: test
description: This rule identifies when Windows Defender Exploit Guard (Attack Surface Reduction) blocks process creation events tied to PSExec and WMI execution. Attackers commonly use PSExec or WMI to run commands remotely for lateral movement while attempting to evade standard application controls, so blocking these paths is security-relevant. It relies on windefend telemetry for EventID 1121 and matches blocked process creation activity involving the WMI provider host (wmiprvse.exe) or the PSExec service process (psexesvc.exe).
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
  - https://twitter.com/duff22b/status/1280166329660497920
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-07-14
modified: 2022-12-25
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1047
  - attack.t1569.002
logsource:
  product: windows
  service: windefend
  definition: "Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)"
detection:
  selection:
    EventID: 1121
    ProcessName|endswith:
      - \wmiprvse.exe
      - \psexesvc.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL