ATT&CK coverage › Technique
Windows Management Instrumentation T1047
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components.
Events covered
14 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 48 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (15 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (305 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 43 rules
- Application Removed Via Wmic.EXE
- Application Terminated Via Wmic.EXE
- Computer System Reconnaissance Via Wmic.EXE
- HackTool - CrackMapExec Execution
- HackTool - CrackMapExec Execution Patterns
- HackTool - Potential Impacket Lateral Movement Activity
- Hardware Model Reconnaissance Via Wmic.EXE
- HTML Help HH.EXE Suspicious Child Process
- New Process Created Via Wmic.EXE
- Password Set to Never Expire via WMI
- Potential Product Class Reconnaissance Via Wmic.EXE
- Potential Product Reconnaissance Via Wmic.EXE
- Potential Remote SquiblyTwo Technique Execution
- Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
- Potential Windows Defender Tampering Via Wmic.EXE
- Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
- Process Reconnaissance Via Wmic.EXE
- PSExec and WMI Process Creations Block
- RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
- Registry Manipulation via WMI Stdregprov
- Script Event Consumer Spawning Process
- Service Reconnaissance Via Wmic.EXE
- Service Started/Stopped Via Wmic.EXE
- Successful Account Login Via WMI
- Suspicious Autorun Registry Modified via WMI
- Suspicious Encoded Scripts in a WMI Consumer
- Suspicious HH.EXE Execution
- Suspicious Microsoft Office Child Process
- Suspicious Process Created Via Wmic.EXE
- Suspicious WMIC Execution Via Office Process
- Suspicious WmiPrvSE Child Process
- System Disk And Volume Reconnaissance Via Wmic.EXE
- T1047 Wmiprvse Wbemcomn DLL Hijack
- Windows Hotfix Updates Reconnaissance Via Wmic.EXE
- WMI Event Consumer Created Named Pipe
- WMIC Remote Command Execution
- WMIC Unquoted Services Path Lookup - PowerShell
- Wmiexec Default Output File
- WMImplant Hack Tool
- WmiPrvSE Spawned A Process
- Wmiprvse Wbemcomn DLL Hijack
- Wmiprvse Wbemcomn DLL Hijack - File
- XSL Script Execution Via WMIC.EXE
Splunk 4 rules
- PowerShell Invoke CIMMethod CIMSession
- PowerShell Invoke WmiExec Usage
- Remote Process Instantiation via WMI and PowerShell Script Block
- Windows WMI Impersonate Token