Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Flags remote creation of wbemcomn.dll in System32\wbem associated with WMI DLL hijack activity.

FreeReviewedSigma · High · v2

Product: windows
Service: security
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR) (SigmaHQ), DRL 1.1
Published: 2020-10-12
Updated: 2026-07-31

ATT&CK techniques

Execution → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.002SMB/Windows Admin Shares
Collection
C2
Exfiltration
Impact

What it detects

This rule flags creation of a file named wbemcomn.dll within C:\Windows\System32\wbem\ when the file operation is sourced over the network (EventID 5145). Attackers may use this placement to enable WMI DLL Hijacking via DLL search order or hijacking patterns. The detection relies on Windows Security auditing for network file access and specifically matches the target filename ending with \wbem\wbemcomn.dll while excluding machine accounts ending with '$'.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange

Malicious Impacket Wmiexec Remote Command Execution Pattern

Malicious Remote Process Creation via WMIC Node

Malicious Impacket WMIExec ADMIN Share Output Redirection

Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)

Malicious Remote Process Creation via wmic node call create

Malicious Impacket wmiexec Output Redirection via ADMIN Share

Windows WMI DLL Hijack via Network-placed wbemcomn.dll in System32\wbem

Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem

Suspicious Access to Citrix Session Evidence Registry Keys

Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Pivot detection · T1021.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-security-remote-wmi-dll-hijack-via-wmiprvse-wbemcomn-dll-placed-in-syste-f6c68d5f

title: "Windows Security Log: Network Write of wbemcomn.dll in System32\\wbem for WMI DLL Hijack (T1047)"
id: 4d825f30-f26d-445f-8427-f45603387c3c
status: test
description: This rule flags creation of a file named wbemcomn.dll within C:\Windows\System32\wbem\ when the file operation is sourced over the network (EventID 5145). Attackers may use this placement to enable WMI DLL Hijacking via DLL search order or hijacking patterns. The detection relies on Windows Security auditing for network file access and specifically matches the target filename ending with \wbem\wbemcomn.dll while excluding machine accounts ending with '$'.
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule Team
date: 2020-10-12
modified: 2022-02-24
tags:
  - attack.execution
  - attack.t1047
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|endswith: \wbem\wbemcomn.dll
  filter:
    SubjectUserName|endswith: $
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f6c68d5f-e101-4b86-8c84-7d96851fd65c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL