Windows Defender Exploit Guard blocks PSExec and WMI process creations (windefend 1121)

title: Windows Defender Exploit Guard blocks PSExec and WMI process creations (windefend 1121)
id: 63ea3259-58a0-411f-920e-8ef20c41cc7b
status: test
description: This rule identifies Windows Defender Exploit Guard (ASR) events where process creation attempts are blocked when they originate from WMI (wmiprvse.exe) or PSExec (psexesvc.exe). Attackers commonly use WMI and PSExec for remote execution and lateral movement, so blocking these execution paths can disrupt credentialed remote control. The detection relies on windefend telemetry showing EventID 1121 and the blocked process names ending with \wmiprvse.exe or \psexesvc.exe.
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
  - https://twitter.com/duff22b/status/1280166329660497920
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-07-14
modified: 2022-12-25
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1047
  - attack.t1569.002
logsource:
  product: windows
  service: windefend
  definition: "Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)"
detection:
  selection:
    EventID: 1121
    ProcessName|endswith:
      - \wmiprvse.exe
      - \psexesvc.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003
    type: derived