huntrule

Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Flags remote creation of wbemcomn.dll in System32\wbem associated with WMI DLL hijack activity.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) (SigmaHQ), DRL 1.1
Published
2020-10-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags creation of a file named wbemcomn.dll within C:\Windows\System32\wbem\ when the file operation is sourced over the network (EventID 5145). Attackers may use this placement to enable WMI DLL Hijacking via DLL search order or hijacking patterns. The detection relies on Windows Security auditing for network file access and specifically matches the target filename ending with \wbem\wbemcomn.dll while excluding machine accounts ending with '$'.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Malicious WMIexec Style Command Output Redirection to Local Admin Share
Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect
Suspicious WMIC Remote Process Creation for Lateral Movement
Suspicious Remote Process Creation and Admin Share Copy via WMIC and Xcopy
Malicious Impacket Wmiexec Remote Command Execution Pattern
Malicious Remote Process Creation via WMIC Node
Malicious Impacket WMIExec ADMIN Share Output Redirection
Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)
Malicious Remote Process Creation via wmic node call create
Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)
Pivot detection · T1021.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.