Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)
Flags ASR blocks (windefend 1121) of process creations tied to WMI (wmiprvse.exe) or PSExec (psexesvc.exe).
- Product
- windows
- Service
- windefend
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2020-07-14
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when Windows Defender Exploit Guard (Attack Surface Reduction) blocks process creation events tied to PSExec and WMI execution. Attackers commonly use PSExec or WMI to run commands remotely for lateral movement while attempting to evade standard application controls, so blocking these paths is security-relevant. It relies on windefend telemetry for EventID 1121 and matches blocked process creation activity involving the WMI provider host (wmiprvse.exe) or the PSExec service process (psexesvc.exe).
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
- twitter.comhttps://twitter.com/duff22b/status/1280166329660497920
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Defender Exploit Guard blocks PSExec/WMI process creations (PsExec service and WMI provider)
id: 63ea3259-58a0-411f-920e-8ef20c41cc7b
status: test
description: This rule identifies when Windows Defender Exploit Guard (Attack Surface Reduction) blocks process creation events tied to PSExec and WMI execution. Attackers commonly use PSExec or WMI to run commands remotely for lateral movement while attempting to evade standard application controls, so blocking these paths is security-relevant. It relies on windefend telemetry for EventID 1121 and matches blocked process creation activity involving the WMI provider host (wmiprvse.exe) or the PSExec service process (psexesvc.exe).
references:
- https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
- https://twitter.com/duff22b/status/1280166329660497920
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
author: Bhabesh Raj, Huntrule Team
date: 2020-07-14
modified: 2022-12-25
tags:
- attack.execution
- attack.lateral-movement
- attack.t1047
- attack.t1569.002
logsource:
product: windows
service: windefend
definition: "Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)"
detection:
selection:
EventID: 1121
ProcessName|endswith:
- \wmiprvse.exe
- \psexesvc.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 97b9ce1e-c5ab-11ea-87d0-0242ac130003
type: derived