Windows PowerShell Command Lines with WMI Process Creation and rundll32 Invocation
Flags Windows command lines where PowerShell/WMI is used to spawn rundll32 from c:\windows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-01-20
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows process creation events where the PowerShell command line contains specific WMI execution strings that create a process calling rundll32 c:\windows. Such chaining is commonly used by attackers to proxy execution through PowerShell and WMI to launch a non-PowerShell binary. It relies on process creation telemetry with access to the full command line, and looks for the presence of the exact required substrings to reduce accidental matches.
Reporting behind it
- symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
- microsoft.comhttps://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Command Lines with WMI Process Creation and rundll32 Invocation
id: f60d5ed0-9953-4a7b-b9a8-3c190f00a103
status: test
description: This rule matches Windows process creation events where the PowerShell command line contains specific WMI execution strings that create a process calling rundll32 c:\windows. Such chaining is commonly used by attackers to proxy execution through PowerShell and WMI to launch a non-PowerShell binary. It relies on process creation telemetry with access to the full command line, and looks for the presence of the exact required substrings to reduce accidental matches.
references:
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
- https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-20
modified: 2022-10-09
tags:
- attack.execution
- attack.t1059.001
- attack.t1047
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_cli_1:
CommandLine|contains|all:
- Invoke-WMIMethod win32_process -name create -argumentlist
- rundll32 c:\windows
selection_cli_2:
CommandLine|contains|all:
- "wmic /node:"
- process call create "rundll32 c:\windows
condition: 1 of selection_*
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: b7155193-8a81-4d8f-805d-88de864ca50c
type: derived