huntrule

Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem

Flags wmiprvse.exe loading wbemcomn.dll from the System32\wbem directory, consistent with a WMI DLL hijack.

FreeReviewedSigma · High · v2
Product
windows
Category
image_load
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2020-10-12
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies cases where wmiprvse.exe loads wbem\wbemcomn.dll from the Windows System32 WMI directory. This file placement and subsequent DLL load can indicate an attempted WMI DLL hijack used for execution or lateral movement. The rule relies on image-load telemetry showing the specific loaded DLL and process image involved in the load.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Malicious Impacket Wmiexec Remote Command Execution Pattern
Malicious Remote Process Creation via WMIC Node
Malicious Impacket WMIExec ADMIN Share Output Redirection
Suspicious Command Shell Spawned by WMI Provider Host Targeting ADMIN Share (via process_creation)
Malicious Remote Process Creation via wmic node call create
Malicious Impacket wmiexec Output Redirection via ADMIN Share
Windows WMI DLL Hijack via Network-placed wbemcomn.dll in System32\wbem
Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)
Suspicious Access to Citrix Session Evidence Registry Keys
Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem
Pivot detection · T1021.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.