Windows: WMI DLL Modules Loaded by Uncommon Image Paths

title: "Windows: WMI DLL Modules Loaded by Uncommon Image Paths"
id: b508f8a7-b155-4d0b-8814-06f4c32680ea
status: test
description: This rule flags cases where specific WMI-related DLLs (e.g., fastprox.dll, wbemprox.dll, wmiclnt.dll) are loaded by a process image that does not match common Windows and .NET framework image paths. Attackers may use WMI module loading to blend into legitimate system behavior or to execute additional functionality through WMI components. The detection relies on image load telemetry that records the loaded DLL name and the loading process image path, along with exclusions for common benign process locations and a small set of known executables.
references:
  - https://threathunterplaybook.com/hunts/windows/190811-WMIModuleLoad/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_wmi_module_load_by_uncommon_process.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-10
modified: 2026-06-29
tags:
  - attack.execution
  - attack.t1047
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \fastprox.dll
      - \wbemcomn.dll
      - \wbemprox.dll
      - \wbemsvc.dll
      - \WmiApRpl.dll
      - \wmiclnt.dll
      - \WMINet_Utils.dll
      - \wmiprov.dll
      - \wmiutils.dll
  filter_main_generic:
    Image|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\explorer.exe
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  filter_optional_other:
    Image|endswith:
      - \WindowsAzureGuestAgent.exe
      - \WaAppAgent.exe
  filter_optional_thor:
    Image|endswith:
      - \thor.exe
      - \thor64.exe
  filter_optional_defender:
    Image|endswith: \MsMpEng.exe
  filter_optional_teams:
    Image|contains:
      - \Microsoft\Teams\current\Teams.exe
      - \Microsoft\Teams\Update.exe
  filter_optional_sysmon:
    Image|endswith:
      - :\Windows\Sysmon.exe
      - :\Windows\Sysmon64.exe
      - :\Windows\Sysmon64a.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 671bb7e3-a020-4824-a00e-2ee5b55f385e
    type: derived