Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)

Flags ASR blocks (windefend 1121) of process creations tied to WMI (wmiprvse.exe) or PSExec (psexesvc.exe).

FreeReviewedSigma · High · v2

Product: windows
Service: windefend
Author: Bhabesh Raj (SigmaHQ), DRL 1.1
Published: 2020-07-14
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
- T1569.002Service Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies when Windows Defender Exploit Guard (Attack Surface Reduction) blocks process creation events tied to PSExec and WMI execution. Attackers commonly use PSExec or WMI to run commands remotely for lateral movement while attempting to evade standard application controls, so blocking these paths is security-relevant. It relies on windefend telemetry for EventID 1121 and matches blocked process creation activity involving the WMI provider host (wmiprvse.exe) or the PSExec service process (psexesvc.exe).

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Zeek DCE-RPC Execution Indicators: JobAdd, Task Scheduler RPC, WMI ExecMethod, and Service Creation/Start

Malicious Impacket wmiexec Command Execution via WmiPrvSE Spawning cmd with Admin-Share Output Redirect (via process_creation)

Malicious QDoor Remote Proxy Execution via WMIC Node Process Call Create of svhost from Temp (via process_creation)

Malicious Remote Payload Deployment via WMIC Node Process Call Create with bitsadmin Transfer (via process_creation)

Malicious WMIexec Style Command Output Redirection to Local Admin Share

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)

Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)

Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)

Pivot detection · T1047 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-defender-exploit-guard-blocks-psexec-and-wmi-process-creations-windefend-97b9ce1e

title: Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)
id: 63ea3259-58a0-411f-920e-8ef20c41cc7b
status: test
description: This rule identifies when Windows Defender Exploit Guard (Attack Surface Reduction) blocks process creation events tied to PSExec and WMI execution. Attackers commonly use PSExec or WMI to run commands remotely for lateral movement while attempting to evade standard application controls, so blocking these paths is security-relevant. It relies on windefend telemetry for EventID 1121 and matches blocked process creation activity involving the WMI provider host (wmiprvse.exe) or the PSExec service process (psexesvc.exe).
references:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
  - https://twitter.com/duff22b/status/1280166329660497920
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-07-14
modified: 2022-12-25
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1047
  - attack.t1569.002
logsource:
  product: windows
  service: windefend
  definition: "Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)"
detection:
  selection:
    EventID: 1121
    ProcessName|endswith:
      - \wmiprvse.exe
      - \psexesvc.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL