Windows Process Creation: PowerShell Execution with Wmiexec Default Flag Sequence

title: "Windows Process Creation: PowerShell Execution with Wmiexec Default Flag Sequence"
id: cda59a3f-20a1-4ed8-beeb-8a695ceeb949
status: test
description: This rule flags Windows process creations where the command line contains a specific sequence of PowerShell flags that matches the default Wmiexec script behavior. Attackers commonly use PowerShell with hidden execution, non-interactive mode, and execution policy bypass to run payloads while reducing visibility. The detection relies on process creation telemetry and a command-line substring match.
references:
  - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-08
tags:
  - attack.lateral-movement
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0
    type: derived