Windows Process Creation Attempt Using wmic.exe process call create

Alerts on Windows process creation attempts invoking wmic.exe with “process call create”, a common pattern for WMI-based execution.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community (SigmaHQ), DRL 1.1
Published: 2019-01-16
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where the executable is wmic.exe and the command line contains the components “process”, “call”, and “create”, consistent with attempting to create a process through WMI. Such execution matters because wmic can be used to run commands on the host, potentially enabling attacker-controlled process execution. The detection relies on Windows process creation telemetry, using fields that identify wmic.exe and match required command-line substrings.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Malicious UAT-8302 Remote Process Execution via wmic

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Malicious Impacket Wmiexec Remote Command Execution Pattern

Malicious Shadow Copy Deletion Via WMI

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)

Malicious Impacket WMIexec Process Execution (via process_creation)

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

Windows Process Creation Attempt Using wmic.exe process call create

Pivot detection · T1047 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-attempt-using-wmic-exe-process-call-create-526be59f

title: Windows Process Creation Attempt Using wmic.exe process call create
id: fb2a9cc8-d186-4bf1-b1bd-3943c8637cfe
related:
  - id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8
    type: derived
  - id: 526be59f-a573-4eea-b5f7-f0973207634d
    type: derived
status: test
description: This rule flags process creation events where the executable is wmic.exe and the command line contains the components “process”, “call”, and “create”, consistent with attempting to create a process through WMI. Such execution matters because wmic can be used to run commands on the host, potentially enabling attacker-controlled process execution. The detection relies on Windows process creation telemetry, using fields that identify wmic.exe and match required command-line substrings.
references:
  - https://www.sans.org/blog/wmic-for-incident-response/
  - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml
author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Huntrule Team
date: 2019-01-16
modified: 2023-02-14
tags:
  - attack.execution
  - attack.t1047
  - car.2016-03-002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains|all:
      - process
      - call
      - create
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
simulation:
  - type: atomic red team
    name: WMI Execute Local Process
    technique: T1047
    atomic_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_process_creation/info.yml
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL