Windows Successful Logons Triggered by WMI (WmiPrvSE.exe)

Flags successful 4624 logons tied to WmiPrvSE.exe, indicating WMI-driven authentication on Windows.

FreeUnreviewedSigmalowv1

windows-successful-logons-triggered-by-wmi-wmiprvse-exe-5af54681

title: Windows Successful Logons Triggered by WMI (WmiPrvSE.exe)
id: ed0cd109-056e-4cd7-bc03-1cb68dd271ae
status: stable
description: This rule identifies successful account logon events (Windows Security EventID 4624) where the originating process is WmiPrvSE.exe, indicating authentication performed via Windows Management Instrumentation. Attackers can use WMI to execute actions under legitimate system and remote management contexts, making this a useful signal for credentialed activity. The detection relies on Windows Security auditing for EventID 4624 and process name details indicating WmiPrvSE.exe.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_wmi_login.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-04
modified: 2024-01-17
tags:
  - attack.execution
  - attack.t1047
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    ProcessName|endswith: \WmiPrvSE.exe
  condition: selection
falsepositives:
  - Monitoring tools
  - Legitimate system administration
level: low
license: DRL-1.1
related:
  - id: 5af54681-df95-4c26-854f-2565e13cfab0
    type: derived

What it detects

This rule identifies successful account logon events (Windows Security EventID 4624) where the originating process is WmiPrvSE.exe, indicating authentication performed via Windows Management Instrumentation. Attackers can use WMI to execute actions under legitimate system and remote management contexts, making this a useful signal for credentialed activity. The detection relies on Windows Security auditing for EventID 4624 and process name details indicating WmiPrvSE.exe.

Known false positives

Monitoring tools
Legitimate system administration

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.