Windows WMI (wmic.exe) Sets User Password to Never Expire

Detects wmic.exe commands that set a Windows account password to never expire via WMI.

FreeUnreviewedSigmamediumv1

windows-wmi-wmic-exe-sets-user-password-to-never-expire-7864a175

title: Windows WMI (wmic.exe) Sets User Password to Never Expire
id: 8c9734e7-00c0-4744-90bd-1e5dd0582ffe
status: experimental
description: This rule flags use of wmic.exe to change a user account property that disables password expiration (passwordexpires set to false). Attackers may use this to maintain persistent access without needing password resets, which can reduce friction for long-term compromise. It relies on Windows process creation telemetry, matching on the process executable name and specific command-line arguments indicating the password expiration setting change.
references:
  - https://www.huntress.com/blog/the-unwanted-guest
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmi_password_never_expire.yml
author: Daniel Koifman (KoifSec), Huntrule Team
date: 2025-07-30
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1047
  - attack.t1098
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \wmic.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains|all:
      - useraccount
      - " set "
      - passwordexpires
      - "false"
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activity
level: medium
license: DRL-1.1
related:
  - id: 7864a175-3654-4824-9f0d-f0da18ab27c0
    type: derived

What it detects

This rule flags use of wmic.exe to change a user account property that disables password expiration (passwordexpires set to false). Attackers may use this to maintain persistent access without needing password resets, which can reduce friction for long-term compromise. It relies on Windows process creation telemetry, matching on the process executable name and specific command-line arguments indicating the password expiration setting change.

Known false positives

Legitimate administrative activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.