Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Flags WmiPrvSE.exe spawning script/utility executables like mshta or regsvr32, with command-line keywords where applicable.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2021-08-23
Updated: 2026-07-30

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1047Windows Management Instrumentation
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1218.010Regsvr32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where WmiPrvSE.exe launches uncommon child executables associated with scripting and living-off-the-land abuse. Attackers may leverage WmiPrvSE as a trusted host to execute commands indirectly through interpreters or utility binaries such as certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, and wscript. It relies on telemetry from Windows process_creation, including parent process image paths and child process image and command line content to match suspicious relationships.

Reporting behind it

Related detections9 linkedT1047 — drag to rearrange

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Windows: Suspicious Process Spawning from Microsoft Office Applications

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

Windows Process Creation: Maze Ransomware Doc Dropper and Shadow Copy Deletion Indicators

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Windows: Alert on Suspicious HH.EXE Process Execution

Suspicious OneNote Spawning Script Interpreter (via process_creation)

Lateral Movement via WMIC Remote Process Creation

Suspicious vbc.exe Spawned by Installer Process

Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes

Pivot detection · T1047 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-wmiprvse-exe-spawning-suspicious-script-and-lolbin-child-processes-8a582fe2

title: Windows WmiPrvSE.exe Spawning Suspicious Script and LOLBIN Child Processes
id: 34b941b8-25bb-417a-9d44-68c82a7cff91
related:
  - id: 692f0bec-83ba-4d04-af7e-e884a96059b6
    type: similar
  - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
    type: similar
  - id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4
    type: obsolete
  - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937
    type: derived
status: test
description: This rule identifies Windows process creation events where WmiPrvSE.exe launches uncommon child executables associated with scripting and living-off-the-land abuse. Attackers may leverage WmiPrvSE as a trusted host to execute commands indirectly through interpreters or utility binaries such as certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, and wscript. It relies on telemetry from Windows process_creation, including parent process image paths and child process image and command line content to match suspicious relationships.
references:
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
  - https://twitter.com/ForensicITGuy/status/1334734244120309760
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml
author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems), Huntrule Team
date: 2021-08-23
modified: 2023-11-10
tags:
  - attack.execution
  - attack.stealth
  - attack.t1047
  - attack.t1204.002
  - attack.t1218.010
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith: \wbem\WmiPrvSE.exe
  selection_children_1:
    Image|endswith:
      - \certutil.exe
      - \cscript.exe
      - \mshta.exe
      - \msiexec.exe
      - \regsvr32.exe
      - \rundll32.exe
      - \verclsid.exe
      - \wscript.exe
  selection_children_2:
    Image|endswith: \cmd.exe
    CommandLine|contains:
      - cscript
      - mshta
      - powershell
      - pwsh
      - regsvr32
      - rundll32
      - wscript
  filter_main_werfault:
    Image|endswith: \WerFault.exe
  filter_main_wmiprvse:
    Image|endswith: \WmiPrvSE.exe
  filter_main_msiexec:
    Image|endswith: \msiexec.exe
    CommandLine|contains: "/i "
  condition: selection_parent and 1 of selection_children_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL