T1047 — Windows Management Instrumentation

Tactic: Execution · Platforms: Windows

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access…

Sigma detection rules (1)

T1047 Windows Management Instrumentation

title: T1047 Windows Management Instrumentation
id: e3eb2ad2-d36f-49f9-9aa6-4f0789ec0ba3
description: 'Detects WmiPrvSE.exe spawning a child process (the signature of remote WMI process creation via Win32_Process.Create) and wmic.exe invoking "process call create" (local/remote WMI process execution). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: WMIQueryScope, TimeWindow, UserContext, RemoteDestinationThreshold, SuspiciousCommandPatterns.'
references:
  - https://attack.mitre.org/techniques/T1047
author: Shahrukh Khan
date: 2026-06-09
license: MIT
tags:
  - attack.execution
  - attack.t1047

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_wmiprvse_child:
    ParentImage|endswith: '\WmiPrvSE.exe'
  selection_wmic_create:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'process call create'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: (selection_wmiprvse_child or selection_wmic_create) and not filter_system_account

falsepositives:
  - Legitimate systems-management tooling (SCCM, monitoring/patching agents) that use WMI to launch processes remotely; System and service accounts are excluded via filter_system_account; tune further with known management-server allowlists if noise remains.

level: medium

Explore