Windows: WmiPrvSE.exe Spawning a Child Process

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where WmiPrvSE.exe is the parent process and a child process is spawned. Attackers often use Windows Management Instrumentation to run code indirectly under the WMI service context, so parent-child process relationships are a useful indicator. The detection relies on Windows process creation telemetry, matching the parent executable path/name and applying exclusions for specific logon IDs and common benign error handling (e.g., WerFault).

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Malicious UAT-8302 Remote Process Execution via wmic

Malicious Remote Encryptor Execution via WMIC Process Call Create (Chaos Ransomware)

Malicious Impacket Wmiexec Remote Command Execution Pattern

Malicious Shadow Copy Deletion Via WMI

Suspicious Remote Process Creation via WMIC Process Call Create (via process_creation)

Suspicious System Reconnaissance via WMI Command-Line Queries (via process_creation)

Malicious Impacket WMIexec Process Execution (via process_creation)

Suspicious Child Process Spawned by WMI Provider Host (via process_creation)

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

Windows: WmiPrvSE.exe Spawning a Child Process

Pivot detection · T1047 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmiprvse-exe-spawning-a-child-process-d21374ff

title: "Windows: WmiPrvSE.exe Spawning a Child Process"
id: 1bc578c6-082d-47d6-a1bf-a83d162f2dd1
related:
  - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937
    type: similar
  - id: 692f0bec-83ba-4d04-af7e-e884a96059b6
    type: similar
  - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
    type: derived
status: stable
description: This rule flags process creation events where WmiPrvSE.exe is the parent process and a child process is spawned. Attackers often use Windows Management Instrumentation to run code indirectly under the WMI service context, so parent-child process relationships are a useful indicator. The detection relies on Windows process creation telemetry, matching the parent executable path/name and applying exclusions for specific logon IDs and common benign error handling (e.g., WerFault).
references:
  - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml
author: Roberto Rodriguez @Cyb3rWard0g, Huntrule Team
date: 2019-08-15
modified: 2023-03-23
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \WmiPrvSe.exe
  filter_logonid:
    LogonId:
      - "0x3e7"
      - "null"
  filter_system_user:
    User|contains:
      - AUTHORI
      - AUTORI
  filter_wmiprvse:
    Image|endswith: \WmiPrvSE.exe
  filter_werfault:
    Image|endswith: \WerFault.exe
  filter_null:
    LogonId: null
  condition: selection and not 1 of filter_*
falsepositives:
  - False positives are expected (e.g. in environments where WinRM is used legitimately)
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL