Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)
Detects Windows file creation matching wmiexec default output filename patterns in admin share and drive paths.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows file creation events matching the default output filename pattern used by the wmiexec tool, including common drive-based variants (e.g., C:\__1<digits>.<digits> and admin share paths). Such temporary/output file creation is a recognizable artifact of wmiexec-style lateral movement and remote execution behavior. It relies on file event telemetry that includes TargetFilename and evaluates the filename path against the specified regular expressions.
Reporting behind it
- crowdstrike.comhttps://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
- github.comhttps://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: wmiexec Default Output File Creation (__1<9 digits>.<1-7 digits>)"
id: 68497868-8822-41ec-931e-05ce2e9c784d
status: test
description: This rule flags Windows file creation events matching the default output filename pattern used by the wmiexec tool, including common drive-based variants (e.g., C:\__1<digits>.<digits> and admin share paths). Such temporary/output file creation is a recognizable artifact of wmiexec-style lateral movement and remote execution behavior. It relies on file event telemetry that includes TargetFilename and evaluates the filename path against the specified regular expressions.
references:
- https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
- https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-02
modified: 2023-03-08
tags:
- attack.lateral-movement
- attack.execution
- attack.t1047
logsource:
category: file_event
product: windows
detection:
selection:
- TargetFilename|re: \\Windows\\__1\d{9}\.\d{1,7}$
- TargetFilename|re: C:\\__1\d{9}\.\d{1,7}$
- TargetFilename|re: D:\\__1\d{9}\.\d{1,7}$
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 8d5aca11-22b3-4f22-b7ba-90e60533e1fb
type: derived