Windows WMIC Remote Query Execution via /node
Identifies remote WMIC queries on Windows by matching WMIC execution with /node: in the command line.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-02-14
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation where WMIC is executed remotely using a /node parameter. Remote WMIC usage can help attackers gather system information or stage further activity on another host. Detection relies on Windows process creation telemetry, matching WMIC executable indicators and CommandLine content that includes /node: while excluding localhost and 127.0.0.1 usage.
Reporting behind it
- securelist.comhttps://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMIC Remote Query Execution via /node
id: af94363d-4494-462f-83b6-bb99db95dff8
related:
- id: e42af9df-d90b-4306-b7fb-05c863847ebd
type: obsolete
- id: 09af397b-c5eb-4811-b2bb-08b3de464ebf
type: obsolete
- id: 7773b877-5abb-4a3e-b9c9-fd0369b59b00
type: derived
status: test
description: "This rule flags Windows process creation where WMIC is executed remotely using a /node parameter. Remote WMIC usage can help attackers gather system information or stage further activity on another host. Detection relies on Windows process creation telemetry, matching WMIC executable indicators and CommandLine content that includes /node: while excluding localhost and 127.0.0.1 usage."
references:
- https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml
author: frack113, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-02-14
modified: 2025-10-22
tags:
- attack.execution
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \WMIC.exe
- OriginalFileName: wmic.exe
selection_cli:
CommandLine|contains|windash: "/node:"
filter_main_localhost:
CommandLine|contains:
- localhost
- 127.0.0.1
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
simulation:
- type: atomic-red-team
name: WMI Execute Remote Process
technique: T1047
atomic_guid: 9c8ef159-c666-472f-9874-90c8d60d136b
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_remote_execution/info.yml
license: DRL-1.1