Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)
Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.
FreeReviewedSigma · High · v2
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-03-08
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation where the command line contains a specific PowerShell flag sequence associated with the Wmiexec script behavior. Attackers may use these flags to run PowerShell non-interactively and hidden, while enabling execution bypass and using encoded payload delivery. Telemetry relies on process creation events with access to the full command line for matching the exact flag substring.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-powershell-execution-with-wmiexec-default-flag-sequence-022eaba8
title: Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)
id: cda59a3f-20a1-4ed8-beeb-8a695ceeb949
status: test
description: This rule identifies Windows process creation where the command line contains a specific PowerShell flag sequence associated with the Wmiexec script behavior. Attackers may use these flags to run PowerShell non-interactively and hidden, while enabling execution bypass and using encoded payload delivery. Telemetry relies on process creation events with access to the full command line for matching the exact flag substring.
references:
- https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-03-08
tags:
- attack.lateral-movement
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0
type: derived