Windows Image Load: WMI DLLs Loaded by Uncommon Process

title: "Windows Image Load: WMI DLLs Loaded by Uncommon Process"
id: b508f8a7-b155-4d0b-8814-06f4c32680ea
status: test
description: This rule flags Windows image loads where specific WMI-related DLLs are loaded by a process image that is not typically expected, based on filtering out common Windows and known agent/process paths. Loading WMI components from unusual processes can indicate abuse of Windows management features for execution, persistence, or discovery. It relies on image-load telemetry that captures the loaded DLL path and the loading process image path.
references:
  - https://threathunterplaybook.com/hunts/windows/190811-WMIModuleLoad/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/image_load/image_load_wmi_module_load_by_uncommon_process.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-10
modified: 2026-06-29
tags:
  - attack.execution
  - attack.t1047
  - detection.threat-hunting
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - \fastprox.dll
      - \wbemcomn.dll
      - \wbemprox.dll
      - \wbemsvc.dll
      - \WmiApRpl.dll
      - \wmiclnt.dll
      - \WMINet_Utils.dll
      - \wmiprov.dll
      - \wmiutils.dll
  filter_main_generic:
    Image|contains:
      - :\Program Files (x86)\
      - :\Program Files\
      - :\Windows\explorer.exe
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
  filter_optional_other:
    Image|endswith:
      - \WindowsAzureGuestAgent.exe
      - \WaAppAgent.exe
  filter_optional_thor:
    Image|endswith:
      - \thor.exe
      - \thor64.exe
  filter_optional_defender:
    Image|endswith: \MsMpEng.exe
  filter_optional_teams:
    Image|contains:
      - \Microsoft\Teams\current\Teams.exe
      - \Microsoft\Teams\Update.exe
  filter_optional_sysmon:
    Image|endswith:
      - :\Windows\Sysmon.exe
      - :\Windows\Sysmon64.exe
      - :\Windows\Sysmon64a.exe
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 671bb7e3-a020-4824-a00e-2ee5b55f385e
    type: derived