Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies successful Windows logon events where the initiating process is WmiPrvSE.exe, indicating authentication tied to WMI activity. Attackers may use WMI to execute commands or interact with systems while leveraging existing authentication paths. The detection relies on Windows Security auditing (Event ID 4624) and correlates the logon to the specific process name suffix for WmiPrvSE.exe.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Lateral Movement via WMIC Remote Process Creation

Malicious UAT-8302 Remote Process Execution via wmic

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Malicious Impacket Wmiexec Remote Command Execution Pattern

Malicious Shadow Copy Deletion Via WMI

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)

Malicious Impacket WMIexec Process Execution (via process_creation)

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)

Pivot detection · T1047 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-successful-logons-triggered-by-wmi-wmiprvse-exe-5af54681

title: Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)
id: ed0cd109-056e-4cd7-bc03-1cb68dd271ae
status: stable
description: This rule identifies successful Windows logon events where the initiating process is WmiPrvSE.exe, indicating authentication tied to WMI activity. Attackers may use WMI to execute commands or interact with systems while leveraging existing authentication paths. The detection relies on Windows Security auditing (Event ID 4624) and correlates the logon to the specific process name suffix for WmiPrvSE.exe.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_wmi_login.yml
author: Thomas Patzke, Huntrule Team
date: 2019-12-04
modified: 2024-01-17
tags:
  - attack.execution
  - attack.t1047
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    ProcessName|endswith: \WmiPrvSE.exe
  condition: selection
falsepositives:
  - Monitoring tools
  - Legitimate system administration
level: low
license: DRL-1.1
related:
  - id: 5af54681-df95-4c26-854f-2565e13cfab0
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL