Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution
Alerts when WMI-backed execution is launched under EdgeTransport.exe, excluding common Exchange and conhost false positives.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-10-11
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where the parent process is EdgeTransport.exe and the spawned activity is consistent with a WMI backdoor using WMI event filters. Such behavior matters because WMI event subscriptions can provide stealthy persistence and code execution tied to system or application events. It relies on Windows process creation telemetry, matching the parent image path and excluding known benign OleConverter/conhost scenarios.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMI Backdoor in Exchange Transport Agent via WMI Event Filter Execution
id: b4a4a59f-e556-4602-bb5e-49a856c82916
status: test
description: This rule flags process executions where the parent process is EdgeTransport.exe and the spawned activity is consistent with a WMI backdoor using WMI event filters. Such behavior matters because WMI event subscriptions can provide stealthy persistence and code execution tied to system or application events. It relies on Windows process creation telemetry, matching the parent image path and excluding known benign OleConverter/conhost scenarios.
references:
- https://twitter.com/cglyer/status/1182389676876980224
- https://twitter.com/cglyer/status/1182391019633029120
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-11
modified: 2023-02-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \EdgeTransport.exe
filter_conhost:
Image: C:\Windows\System32\conhost.exe
filter_oleconverter:
Image|startswith: C:\Program Files\Microsoft\Exchange Server\
Image|endswith: \Bin\OleConverter.exe
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 797011dc-44f4-4e6f-9f10-a8ceefbe566b
type: derived