Suspicious WmiPrvSE Child Process

Severity: high
Author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)
Source: upstream

Detects suspicious and uncommon child processes of WmiPrvSE

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation, `T1204.002` User Execution: Malicious File
Defense Evasion	`T1218.010` System Binary Proxy Execution: Regsvr32

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation
Security-Auditing	4688	A new process has been created.

Stages and Predicates

Stage 1: `selection_parent`

ParentImage|endswith: '\wbem\WmiPrvSE.exe'

Stage 2: `1 of selection_children_1`

or:
Image|endswith: '\certutil.exe'
Image|endswith: '\cscript.exe'
Image|endswith: '\mshta.exe'
Image|endswith: '\msiexec.exe'
Image|endswith: '\regsvr32.exe'
Image|endswith: '\rundll32.exe'
Image|endswith: '\verclsid.exe'
Image|endswith: '\wscript.exe'

Stage 3: `1 of selection_children_2`

or:
CommandLine|contains: cscript
CommandLine|contains: mshta
CommandLine|contains: powershell
CommandLine|contains: pwsh
CommandLine|contains: regsvr32
CommandLine|contains: rundll32
CommandLine|contains: wscript
Image|endswith: '\cmd.exe'

Stage 4: `not 1 of filter_main_*`

or:
CommandLine|contains: '/i '
Image|endswith: '\msiexec.exe'
Image|endswith: '\WerFault.exe'
Image|endswith: '\WmiPrvSE.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`/i` `cscript` corpus 12 (sigma 12) `mshta` corpus 11 (sigma 11) `powershell` corpus 16 (sigma 16) `pwsh` corpus 5 (sigma 5) `regsvr32` corpus 11 (sigma 11) `rundll32` corpus 19 (sigma 19) `wscript` corpus 12 (sigma 12)
`Image`	ends_with	`\WerFault.exe` corpus 8 (sigma 8) `\WmiPrvSE.exe` corpus 3 (sigma 3) `\certutil.exe` corpus 34 (sigma 34) `\cmd.exe` corpus 92 (sigma 92) `\cscript.exe` corpus 64 (sigma 64) `\mshta.exe` corpus 57 (sigma 57) `\msiexec.exe` corpus 21 (sigma 21) `\regsvr32.exe` corpus 57 (sigma 57) `\rundll32.exe` corpus 76 (sigma 76) `\verclsid.exe` corpus 4 (sigma 4) `\wscript.exe` corpus 64 (sigma 64)
`ParentImage`	ends_with	`\wbem\WmiPrvSE.exe`

Suspicious WmiPrvSE Child Process

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: selection_parent

Stage 2: 1 of selection_children_1

Stage 3: 1 of selection_children_2

Stage 4: not 1 of filter_main_*

Indicators

Stage 1: `selection_parent`

Stage 2: `1 of selection_children_1`

Stage 3: `1 of selection_children_2`

Stage 4: `not 1 of filter_main_*`