Detect WMI method invocation and WMI-spawned child processes

Siemphony@siemphonymediumT1047verified in labPlaybook · Lateral movement

Matches T1047 where it lands on the victim rather than on the operator's console: any process whose parent is `WmiPrvSE.exe`, which is what remote WMI execution produces on the target — wmiexec, the COM API and `Invoke-WmiMethod -ComputerName` all arrive that way and carry none of the literals an operator types. The command-line arms cover the local forms and are ANDed token-wise rather than as one contiguous substring, so `wmic process call create` with doubled spaces still matches, and `/node:` is bound to `call` so read-only remote inventory (`wmic /node:HOST os get caption`) stays out of scope — unbound, that one term is the noisiest thing in a managed Windows estate and outnumbers real execution by orders of magnitude. OR-ing `ParentImage` against `CommandLine` is what Wazuh cannot express in a single rule; the parent arm is worth the refusal because it is the only arm that sees the remote case at all. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0364, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect WMI method invocation and WMI-spawned child processes2id: f950254a-bf01-4f34-8eeb-3c6bdb58dce83status: experimental4description: |5  Matches T1047 where it lands on the victim rather than on the operator's6  console: any process whose parent is `WmiPrvSE.exe`, which is what remote WMI7  execution produces on the target — wmiexec, the COM API and8  `Invoke-WmiMethod -ComputerName` all arrive that way and carry none of the9  literals an operator types. The command-line arms cover the local forms and10  are ANDed token-wise rather than as one contiguous substring, so11  `wmic  process  call  create` with doubled spaces still matches, and `/node:`12  is bound to `call` so read-only remote inventory (`wmic /node:HOST os get13  caption`) stays out of scope — unbound, that one term is the noisiest thing14  in a managed Windows estate and outnumbers real execution by orders of15  magnitude. OR-ing `ParentImage` against `CommandLine` is what Wazuh cannot16  express in a single rule; the parent arm is worth the refusal because it is17  the only arm that sees the remote case at all.18  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0364, not hand-written and not tested by its author. Any lab result is on this rule's own page.19references:20  - https://attack.mitre.org/techniques/T104721  - https://attack.mitre.org/detectionstrategies/DET036422author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)23date: 2026-08-1624tags:25  - attack.execution26  - attack.t104727logsource:28  category: process_creation29  product: windows30detection:31  selection_wmi_host_child:32    ParentImage|endswith: '\WmiPrvSE.exe'33  selection_wmic_create:34    CommandLine|contains|all:35      - 'process'36      - 'call'37      - 'create'38  selection_wmic_remote_call:39    CommandLine|contains|all:40      - '/node:'41      - 'call'42  selection_wmi_class_create:43    CommandLine|contains|all:44      - 'Win32_Process'45      - 'Create'46  selection_wmi_cmdlet:47    CommandLine|contains:48      - 'Invoke-WmiMethod'49      - 'Invoke-CimMethod'50  condition: 1 of selection_*51falsepositives:52  - "Every sanctioned remote WMI action lands on the target as a `WmiPrvSE.exe` child, so software distribution, patch orchestration, inventory agents and helpdesk runbooks that run anything remotely all match the parent arm. The process tree is indistinguishable from wmiexec's, which is why MITRE exposes UserContext and RemoteDestinationThreshold — baseline which accounts and which management servers legitimately drive WMI before this arm is enabled."53  - "Endpoint-management agents that call `wmic process call create` or `Invoke-WmiMethod` under SYSTEM on a schedule, and vendor installers that use `Win32_Process.Create` to relaunch themselves elevated. These recur at predictable intervals from a small set of parent processes."54  - "`Invoke-CimMethod` is also the documented `PS_ScheduledTask` path for registering a scheduled task, so an estate that creates tasks that way matches here and again under T1053.005 — one event, two technique tags, and neither alert is wrong."55level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (InitiatingProcessFolderPath endswith "\\WmiPrvSE.exe" or (ProcessCommandLine contains "process" and ProcessCommandLine contains "call" and ProcessCommandLine contains "create") or (ProcessCommandLine contains "/node:" and ProcessCommandLine contains "call") or (ProcessCommandLine contains "Win32_Process" and ProcessCommandLine contains "Create") or (ProcessCommandLine contains "Invoke-WmiMethod" or ProcessCommandLine contains "Invoke-CimMethod"))

Splunk · SPL

Run this as a search.

index=* (ParentImage="*\\WmiPrvSE.exe" OR (CommandLine="*process*" AND CommandLine="*call*" AND CommandLine="*create*") OR (CommandLine="*/node:*" AND CommandLine="*call*") OR (CommandLine="*Win32_Process*" AND CommandLine="*Create*") OR (CommandLine="*Invoke-WmiMethod*" OR CommandLine="*Invoke-CimMethod*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.parent.executable) LIKE "*\\\\wmiprvse.exe" OR (TO_LOWER(process.command_line) LIKE "*process*" AND TO_LOWER(process.command_line) LIKE "*call*" AND TO_LOWER(process.command_line) LIKE "*create*") OR (TO_LOWER(process.command_line) LIKE "*/node:*" AND TO_LOWER(process.command_line) LIKE "*call*") OR (TO_LOWER(process.command_line) LIKE "*win32_process*" AND TO_LOWER(process.command_line) LIKE "*create*") OR (TO_LOWER(process.command_line) LIKE "*invoke-wmimethod*" OR TO_LOWER(process.command_line) LIKE "*invoke-cimmethod*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 5 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\WmiPrvSE\.exe$</field>    <description>Detect WMI method invocation and WMI-spawned child processes (1/5)</description>    <mitre>      <id>T1047</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:process))(?=.*(?:call))(?=.*(?:create)).*</field>    <description>Detect WMI method invocation and WMI-spawned child processes (2/5)</description>    <mitre>      <id>T1047</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:/node:))(?=.*(?:call)).*</field>    <description>Detect WMI method invocation and WMI-spawned child processes (3/5)</description>    <mitre>      <id>T1047</id>    </mitre>  </rule>   <rule id="100003" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:Win32_Process))(?=.*(?:Create)).*</field>    <description>Detect WMI method invocation and WMI-spawned child processes (4/5)</description>    <mitre>      <id>T1047</id>    </mitre>  </rule>   <rule id="100004" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(Invoke-WmiMethod|Invoke-CimMethod)</field>    <description>Detect WMI method invocation and WMI-spawned child processes (5/5)</description>    <mitre>      <id>T1047</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: f950254a-bf01-4f34-8eeb-3c6bdb58dce8

ATT&CKT1047

T1047Windows Management Instrumentation

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — Remote command execution over WMI IWbemServices (Empire)
passed
Siemphony IR · 3 Sept 2026
1 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1047, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Apply MITRE's UserContext knob first: baseline which SYSTEM-invoked callers
RemoteDestinationThreshold — MITRE's count of unique remote hosts inside a
WMIQueryScope (\root\subscription in particular) needs the WMI-Activity
If /node: proves too noisy, split it into its own lower-severity rule rather

Declared by the author

Every sanctioned remote WMI action lands on the target as a WmiPrvSE.exe child, so software distribution, patch orchestration, inventory agents and helpdesk runbooks that run anything remotely all match the parent arm. The process tree is indistinguishable from wmiexec's, which is why MITRE exposes UserContext and RemoteDestinationThreshold — baseline which accounts and which management servers legitimately drive WMI before this arm is enabled.
Endpoint-management agents that call wmic process call create or Invoke-WmiMethod under SYSTEM on a schedule, and vendor installers that use Win32_Process.Create to relaunch themselves elevated. These recur at predictable intervals from a small set of parent processes.
Invoke-CimMethod is also the documented PS_ScheduledTask path for registering a scheduled task, so an estate that creates tasks that way matches here and again under T1053.005 — one event, two technique tags, and neither alert is wrong.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

Command lines that invoke WMI as an execution vector: the WMIC process-creation verb, the switch that aims WMIC at another host, and the two PowerShell cmdlets that call WMI/CIM methods. MITRE's analytic AN1031 is explicitly a chain — "process creation, command execution, and corresponding network connection if remote" — spanning Sysmon EventID 1, Sysmon 3/22, and the Microsoft-Windows-WMI-Activity channel (5857/5858/5860/5861). Sigma cannot join across log sources, so this rule holds the process-creation link and uses a textual proxy for the network link: /node: says the operator intended a remote target. That is an intent string in a command line, not an observed connection — keep the difference in the alert narrative.

02 · Telemetry you need

Sysmon EventID 1 with CommandLine populated, or Security 4688 with "Include
Command lines that are not truncated. Long WMIC invocations are exactly the
PowerShell Script Block Logging (4104), for the reason below.
For the links this rule drops: Sysmon EventID 3 and the WMI-Activity channel.

03 · How the logic works

A single selection on one field, five substrings:

These are MITRE's SuspiciousCommandPatterns knob turned into literals — the brief names wmic process call and powershell Invoke-WmiMethod as examples. process call create matches the verb, not wmic.exe. That is the important choice: copying or renaming wmic.exe — a routine evasion — defeats an Image|endswith: '\wmic.exe' rule and does nothing to this one, because the argument string survives the rename. /node: and -node: are both listed because Windows accepts either prefix. Sigma's windash modifier would have generated the pair automatically; writing them out keeps the rendered SPL and KQL readable, at the cost of a line. The whole match sits on CommandLine, which is what keeps all four backends rendering — translations.json records no refusals. The cmdlet gap. Invoke-WmiMethod and Invoke-CimMethod only reach a command line when they are passed inline (powershell -Command "Invoke-..."). The same cmdlet inside a .ps1 file never appears in EventID 1 at all. Half of the PowerShell coverage this rule appears to offer is only reachable through 4104, which is a different log source. Direction matters. This rule watches the source of remote WMI. On the target host, WMI execution lands as a WmiPrvSE.exe child with no /node: and no process call create anywhere in sight. Do not expect it to fire on both ends.

04 · Common false positives

Endpoint-management agents — software distribution, patching, inventory —
Administrative automation from a jump box, where one account legitimately
Vendor installer and uninstaller scripts using Invoke-CimMethod. Note that

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0364, never executed against a log line. Nothing here has been measured; the medium level is a judgement, not a result.
tier_2: means running it over historical data, finding which of the five terms carries your volume, and pinning the SYSTEM callers by name.
tier_3: means restoring MITRE's chain: this process creation correlated with the Sysmon EventID 3 connection and the WMI-Activity events on the target, inside a defined TimeWindow.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/f950254a-bf01-4f34-8eeb-3c6bdb58dce8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect WMI method invocation and WMI-spawned child processes

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it