Windows: WmiPrvSE.exe Spawning a Child Process

Identifies child processes created by WmiPrvSE.exe on Windows, highlighting potential WMI-based execution attempts.

FreeUnreviewedSigmamediumv1

windows-wmiprvse-exe-spawning-a-child-process-d21374ff

title: "Windows: WmiPrvSE.exe Spawning a Child Process"
id: 1bc578c6-082d-47d6-a1bf-a83d162f2dd1
related:
  - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937
    type: similar
  - id: 692f0bec-83ba-4d04-af7e-e884a96059b6
    type: similar
  - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
    type: derived
status: stable
description: This rule flags process creation events where WmiPrvSE.exe is the parent process and a child process is spawned. Attackers often use Windows Management Instrumentation to run code indirectly under the WMI service context, so parent-child process relationships are a useful indicator. The detection relies on Windows process creation telemetry, matching the parent executable path/name and applying exclusions for specific logon IDs and common benign error handling (e.g., WerFault).
references:
  - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-15
modified: 2023-03-23
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WmiPrvSe.exe
  filter_logonid:
    LogonId:
      - "0x3e7"
      - "null"
  filter_system_user:
    User|contains:
      - AUTHORI
      - AUTORI
  filter_wmiprvse:
    Image|endswith: \WmiPrvSE.exe
  filter_werfault:
    Image|endswith: \WerFault.exe
  filter_null:
    LogonId: null
  condition: selection and not 1 of filter_*
falsepositives:
  - False positives are expected (e.g. in environments where WinRM is used legitimately)
level: medium
license: DRL-1.1

What it detects

This rule flags process creation events where WmiPrvSE.exe is the parent process and a child process is spawned. Attackers often use Windows Management Instrumentation to run code indirectly under the WMI service context, so parent-child process relationships are a useful indicator. The detection relies on Windows process creation telemetry, matching the parent executable path/name and applying exclusions for specific logon IDs and common benign error handling (e.g., WerFault).

Known false positives

False positives are expected (e.g. in environments where WinRM is used legitimately)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.