Windows WMIC.exe Service Reconnaissance via Remote Service Queries
Flags WMIC.exe commands containing service-related reconnaissance strings while excluding stop/start service manipulation.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-14
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where WMIC.exe is used with command-line content related to service reconnaissance. It looks for “service” in the command line while matching additional service-management method strings and excluding commands associated with stop/start service manipulation. This matters because attackers may use WMIC and WMI to enumerate remote service availability and configuration, relying on Windows process creation telemetry to capture the executed binary and its arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMIC.exe Service Reconnaissance via Remote Service Queries
id: 8728533b-58be-4afa-b733-b2195965d5b4
related:
- id: 68bcd73b-37ef-49cb-95fc-edc809730be6
type: similar
- id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
type: derived
status: test
description: This rule identifies process creation events where WMIC.exe is used with command-line content related to service reconnaissance. It looks for “service” in the command line while matching additional service-management method strings and excluding commands associated with stop/start service manipulation. This matters because attackers may use WMIC and WMI to enumerate remote service availability and configuration, relying on Windows process creation telemetry to capture the executed binary and its arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-14
modified: 2026-01-07
tags:
- attack.execution
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \WMIC.exe
- OriginalFileName: wmic.exe
selection_cli:
CommandLine|contains: service
filter_main_manipulation:
CommandLine|contains:
- stopservice
- startservice
filter_main_win32_methods:
CommandLine|contains:
- Change
- Create
- Delete
- PauseService
- ResumeService
- SetSecurityDescriptor
- StartService
- StopService
- UserControlService
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
simulation:
- type: atomic-red-team
name: WMI Reconnaissance List Remote Services
technique: T1047
atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml
license: DRL-1.1