Login with WMI

May 2, 2023 · attack.execution attack.t1047 ·

Share on:

Detection of logins performed with WMI

Sigma rule (View on GitHub)

 1title: Login with WMI
 2id: 5af54681-df95-4c26-854f-2565e13cfab0
 3status: stable
 4description: Detection of logins performed with WMI
 5author: Thomas Patzke
 6date: 2019/12/04
 7tags:
 8    - attack.execution
 9    - attack.t1047
10logsource:
11    product: windows
12    service: security
13detection:
14    selection:
15        EventID: 4624
16        ProcessName|endswith: '\WmiPrvSE.exe'
17    condition: selection
18falsepositives:
19    - Monitoring tools
20    - Legitimate system administration
21level: low

Related rules

Suspicious Microsoft Office Child Process
HTML Help HH.EXE Suspicious Child Process
Suspicious HH.EXE Execution
Suspicious WmiPrvSE Child Process
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell