T1047 Windows Management Instrumentation — Detection Rules

Detection workspace for T1047 Windows Management Instrumentation: 47 Sigma sources, 1 Atlas concepts and 0 anomaly models. No live detection validation.

Source-backed rule directory

Remote DCOM/WMI Lateral Movement · test · high · {"product":"rpc_firewall","category":"application","definition":"Requirements: install and apply the RPC Firewall to all processes with \"audit:true action:block uuid:367abb81-9844-35f1-ad32-98f038001003"}
MITRE BZAR Indicators for Execution · test · medium · {"product":"zeek","service":"dce_rpc"}
Successful Account Login Via WMI · stable · low · {"product":"windows","service":"security"}
T1047 Wmiprvse Wbemcomn DLL Hijack · test · high · {"product":"windows","service":"security"}
PSExec and WMI Process Creations Block · test · high · {"product":"windows","service":"windefend","definition":"Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)"}
Wmiexec Default Output File · test · critical · {"category":"file_event","product":"windows"}
Wmiprvse Wbemcomn DLL Hijack - File · test · critical · {"product":"windows","category":"file_event"}
Wmiprvse Wbemcomn DLL Hijack · test · high · {"product":"windows","category":"image_load"}
WMI Event Consumer Created Named Pipe · test · medium · {"product":"windows","category":"pipe_created","definition":"Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575"}
WMIC Unquoted Services Path Lookup - PowerShell · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
WMImplant Hack Tool · test · high · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
Suspicious Autorun Registry Modified via WMI · experimental · high · {"category":"process_creation","product":"windows"}
HTML Help HH.EXE Suspicious Child Process · test · high · {"category":"process_creation","product":"windows"}
Suspicious HH.EXE Execution · test · high · {"category":"process_creation","product":"windows"}
HackTool - CrackMapExec Execution · test · high · {"category":"process_creation","product":"windows"}
HackTool - CrackMapExec Execution Patterns · stable · high · {"category":"process_creation","product":"windows"}
HackTool - Potential Impacket Lateral Movement Activity · stable · high · {"category":"process_creation","product":"windows"}
Suspicious Microsoft Office Child Process · test · high · {"category":"process_creation","product":"windows"}
RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class · experimental · medium · {"category":"process_creation","product":"windows"}
Script Event Consumer Spawning Process · test · high · {"category":"process_creation","product":"windows"}
Password Set to Never Expire via WMI · experimental · medium · {"category":"process_creation","product":"windows"}
Potential Windows Defender Tampering Via Wmic.EXE · test · high · {"product":"windows","category":"process_creation"}
Process Creation Attempt via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Computer System Reconnaissance Via Wmic.EXE · test · medium · {"product":"windows","category":"process_creation"}
Hardware Model Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Windows Hotfix Updates Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential Process Reconnaissance via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential Product Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential Product Class Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Service Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Potential Unquoted Service Path Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
System Disk And Volume Reconnaissance Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
WMIC Remote Command Execution · test · medium · {"category":"process_creation","product":"windows"}
Service Started/Stopped Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Service Startup Type Change Via Wmic.EXE · experimental · medium · {"category":"process_creation","product":"windows"}
Potential Remote SquiblyTwo Technique Execution · test · high · {"category":"process_creation","product":"windows"}
Registry Enumeration via WMI Stdregprov · experimental · medium · {"category":"process_creation","product":"windows"}
Registry Manipulation via WMI Stdregprov · experimental · medium · {"category":"process_creation","product":"windows"}
Suspicious WMIC Execution Via Office Process · test · high · {"product":"windows","category":"process_creation"}
Suspicious Process Created Via Wmic.EXE · test · high · {"category":"process_creation","product":"windows"}
Application Termination Attempt via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
Application Removed Via Wmic.EXE · test · medium · {"category":"process_creation","product":"windows"}
XSL Script Execution Via WMIC.EXE · test · medium · {"category":"process_creation","product":"windows"}
WmiPrvSE Spawned A Process · stable · medium · {"category":"process_creation","product":"windows"}
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell · stable · medium · {"category":"process_creation","product":"windows"}
Suspicious WmiPrvSE Child Process · test · high · {"product":"windows","category":"process_creation"}
Suspicious Encoded Scripts in a WMI Consumer · test · high · {"product":"windows","category":"wmi_event"}

Atlas deterministic concepts

T1047 Windows Management Instrumentation

Published pseudocode, not an executable rule

MATCH(wmi_process_or_remote_operation) AND caller_or_command NOT_IN approved_wmi_activity -> ALERT

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0364 Behavioral Detection Strategy for WMI Execution Abuse on Windows

AN1031 Analytic 1031

Detects adversarial abuse of WMI to execute local or remote commands via WMIC, PowerShell, or COM API through a multi-event chain: process creation, command execution, and corresponding network connection if remote.

Connected ecosystem references

Linked tags

rule_source_available

Simulation, tools and telemetry

T1047 simulation workspace

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing anomaly research

Original publication snapshot · Anomaly Detection Atlas

Complete technique engineering workbook

Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check

Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.

Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.