Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)

Flags successful 4624 logons tied to WmiPrvSE.exe, indicating WMI-driven authentication on Windows.

FreeReviewedSigma · Low · v2

Product: windows
Service: security
Author: Thomas Patzke (SigmaHQ), DRL 1.1
Published: 2019-12-04
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies successful Windows logon events where the initiating process is WmiPrvSE.exe, indicating authentication tied to WMI activity. Attackers may use WMI to execute commands or interact with systems while leveraging existing authentication paths. The detection relies on Windows Security auditing (Event ID 4624) and correlates the logon to the specific process name suffix for WmiPrvSE.exe.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Malicious WMIexec Style Command Output Redirection to Local Admin Share

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

Malicious Shadow Copy Deletion via WMIC via Process Creation (via process_creation)

Suspicious System Reconnaissance Output Redirected to PDF File (via process_creation)

Suspicious Phantom Taurus mssq.bat SQL Execution via WMI (via process_creation)

Malicious Antivirus Removal via WMIC Product Uninstall

Suspicious Remote Process Creation via WMIC by Mallox

Malicious Akira Shadow Copy Deletion via PowerShell WMI (via process_creation)

Suspicious Sysinternals EULA Acceptance Registry Write Linked to INC Ransomware

Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)

Pivot detection · T1047 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-successful-logons-triggered-by-wmi-wmiprvse-exe-5af54681

title: Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)
id: ed0cd109-056e-4cd7-bc03-1cb68dd271ae
status: stable
description: This rule identifies successful Windows logon events where the initiating process is WmiPrvSE.exe, indicating authentication tied to WMI activity. Attackers may use WMI to execute commands or interact with systems while leveraging existing authentication paths. The detection relies on Windows Security auditing (Event ID 4624) and correlates the logon to the specific process name suffix for WmiPrvSE.exe.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_wmi_login.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-04
modified: 2024-01-17
tags:
  - attack.execution
  - attack.t1047
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    ProcessName|endswith: \WmiPrvSE.exe
  condition: selection
falsepositives:
  - Monitoring tools
  - Legitimate system administration
level: low
license: DRL-1.1
related:
  - id: 5af54681-df95-4c26-854f-2565e13cfab0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL