Windows WMI DLL Hijack via wbemcomn.dll Loaded by wmiprvse.exe

Flags wmiprvse.exe loading wbemcomn.dll from the System32\wbem directory, consistent with a WMI DLL hijack.

FreeUnreviewedSigmahighv1

windows-wmi-dll-hijack-via-wbemcomn-dll-loaded-by-wmiprvse-exe-7707a579

title: Windows WMI DLL Hijack via wbemcomn.dll Loaded by wmiprvse.exe
id: 062bd48e-0d24-4243-93c3-4ce4adcb1b59
status: test
description: This rule identifies a WMI DLL hijack pattern where wmiprvse.exe loads a DLL named wbemcomn.dll from the Windows System32 WMI directory. Attackers may use this technique to execute malicious code in the context of a legitimate Windows management process, enabling stealthy execution and potential lateral movement. The detection relies on process image load telemetry indicating wmiprvse.exe loading a specific DLL path.
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-12
modified: 2022-10-09
tags:
  - attack.execution
  - attack.t1047
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  category: image_load
detection:
  selection:
    Image|endswith: \wmiprvse.exe
    ImageLoaded|endswith: \wbem\wbemcomn.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 7707a579-e0d8-4886-a853-ce47e4575aaa
    type: derived

What it detects

This rule identifies a WMI DLL hijack pattern where wmiprvse.exe loads a DLL named wbemcomn.dll from the Windows System32 WMI directory. Attackers may use this technique to execute malicious code in the context of a legitimate Windows management process, enabling stealthy execution and potential lateral movement. The detection relies on process image load telemetry indicating wmiprvse.exe loading a specific DLL path.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.