huntrule

Windows WMIC.exe Service Reconnaissance via Remote Service Queries

Flags WMIC.exe commands containing service-related reconnaissance strings while excluding stop/start service manipulation.

FreeUnreviewedSigmamediumv1
title: Windows WMIC.exe Service Reconnaissance via Remote Service Queries
id: 8728533b-58be-4afa-b733-b2195965d5b4
related:
  - id: 68bcd73b-37ef-49cb-95fc-edc809730be6
    type: similar
  - id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
    type: derived
status: test
description: This rule identifies process creation events where WMIC.exe is used with command-line content related to service reconnaissance. It looks for “service” in the command line while matching additional service-management method strings and excluding commands associated with stop/start service manipulation. This matters because attackers may use WMIC and WMI to enumerate remote service availability and configuration, relying on Windows process creation telemetry to capture the executed binary and its arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-14
modified: 2026-01-07
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \WMIC.exe
    - OriginalFileName: wmic.exe
  selection_cli:
    CommandLine|contains: service
  filter_main_manipulation:
    CommandLine|contains:
      - stopservice
      - startservice
  filter_main_win32_methods:
    CommandLine|contains:
      - Change
      - Create
      - Delete
      - PauseService
      - ResumeService
      - SetSecurityDescriptor
      - StartService
      - StopService
      - UserControlService
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
simulation:
  - type: atomic-red-team
    name: WMI Reconnaissance List Remote Services
    technique: T1047
    atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml
license: DRL-1.1

What it detects

This rule identifies process creation events where WMIC.exe is used with command-line content related to service reconnaissance. It looks for “service” in the command line while matching additional service-management method strings and excluding commands associated with stop/start service manipulation. This matters because attackers may use WMIC and WMI to enumerate remote service availability and configuration, relying on Windows process creation telemetry to capture the executed binary and its arguments.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.