Analytic rule catalog
WMI Spawning Suspicious Child Process Living off the Land
Back
| Id | 3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f |
| Rulename | WMI Spawning Suspicious Child Process (Living off the Land) |
| Description | Detects WmiPrvSE.exe (the WMI Provider Host) spawning high-risk processes such as PowerShell, cmd.exe, cscript, or other LOLBins. WMI requires no external tools, generates minimal disk artifacts, and can execute code on remote systems over DCOM/RPC while bypassing many controls. Tune AllowlistedCmdPatterns for known-safe management tools such as SCCM. |
| Severity | High |
| Tactics | Execution LateralMovement Persistence |
| Techniques | T1047 T1021.006 T1059.001 T1059.003 T1059.005 |
| Required data connectors | MicrosoftThreatProtection SecurityEvents |
| Kind | Scheduled |
| Query frequency | 1h |
| Query period | 1h |
| Trigger threshold | 0 |
| Trigger operator | gt |
| Source Uri | https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows%20Security%20Events/Analytic%20Rules/WMI-Abuse.yaml |
| Version | 1.0.5 |
| Arm template | 3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f.json |
let Lookback = 1h;
let SuspiciousChildProcesses = dynamic([
"powershell.exe", "pwsh.exe", "cmd.exe", "cscript.exe", "wscript.exe",
"mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe",
"rundll32.exe", "msiexec.exe", "installutil.exe", "cmstp.exe",
"msbuild.exe", "wmic.exe", "net.exe", "net1.exe", "nltest.exe",
"whoami.exe", "ipconfig.exe", "tasklist.exe", "schtasks.exe",
"at.exe", "sc.exe", "reg.exe"
]);
let AllowlistedCmdPatterns = dynamic([
"ccmexec", "SMSAgent", "MOMAgent", "nessus", "qualys"
]);
let NetworkIndicators = dynamic([
"http://", "https://", "ftp://", "Net.WebClient",
"DownloadString", "IEX", "Invoke-Expression", "/transfer", "-urlcache"
]);
let CredentialIndicators = dynamic([
"lsass", "mimikatz", "sekurlsa", "dump", "sam", "ntds"
]);
let MDE_Results =
DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where InitiatingProcessFileName =~ "WmiPrvSE.exe"
| where FileName in~ (SuspiciousChildProcesses)
| where not(ProcessCommandLine has_any (AllowlistedCmdPatterns))
| extend
ChildProcess = FileName,
ChildCmdLine = ProcessCommandLine,
AccountName = InitiatingProcessAccountName,
AccountDomain = InitiatingProcessAccountDomain,
HostName = DeviceName,
EventTime = Timestamp,
NetworkActivity = ProcessCommandLine has_any (NetworkIndicators),
CredentialActivity = ProcessCommandLine has_any (CredentialIndicators)
| project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
ChildCmdLine, NetworkActivity, CredentialActivity;
let SecEvent_Results =
SecurityEvent
| where TimeGenerated >= ago(Lookback)
| where EventID == 4688
| where ParentProcessName endswith "\\WmiPrvSE.exe"
| extend ChildProcess = tostring(split(NewProcessName, "\\")[-1])
| where ChildProcess in~ (SuspiciousChildProcesses)
| where not(CommandLine has_any (AllowlistedCmdPatterns))
| extend
ChildCmdLine = CommandLine,
AccountName = SubjectUserName,
AccountDomain = SubjectDomainName,
HostName = Computer,
EventTime = TimeGenerated,
NetworkActivity = CommandLine has_any (NetworkIndicators),
CredentialActivity = CommandLine has_any (CredentialIndicators)
| project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
ChildCmdLine, NetworkActivity, CredentialActivity;
union MDE_Results, SecEvent_Results
| extend RiskScore = iif(CredentialActivity == true, 3, iif(NetworkActivity == true, 2, 1))
| sort by RiskScore desc, EventTime desc
severity: High
relevantTechniques:
- T1047
- T1021.006
- T1059.001
- T1059.003
- T1059.005
version: 1.0.5
triggerThreshold: 0
tactics:
- Execution
- LateralMovement
- Persistence
query: |
let Lookback = 1h;
let SuspiciousChildProcesses = dynamic([
"powershell.exe", "pwsh.exe", "cmd.exe", "cscript.exe", "wscript.exe",
"mshta.exe", "certutil.exe", "bitsadmin.exe", "regsvr32.exe",
"rundll32.exe", "msiexec.exe", "installutil.exe", "cmstp.exe",
"msbuild.exe", "wmic.exe", "net.exe", "net1.exe", "nltest.exe",
"whoami.exe", "ipconfig.exe", "tasklist.exe", "schtasks.exe",
"at.exe", "sc.exe", "reg.exe"
]);
let AllowlistedCmdPatterns = dynamic([
"ccmexec", "SMSAgent", "MOMAgent", "nessus", "qualys"
]);
let NetworkIndicators = dynamic([
"http://", "https://", "ftp://", "Net.WebClient",
"DownloadString", "IEX", "Invoke-Expression", "/transfer", "-urlcache"
]);
let CredentialIndicators = dynamic([
"lsass", "mimikatz", "sekurlsa", "dump", "sam", "ntds"
]);
let MDE_Results =
DeviceProcessEvents
| where Timestamp >= ago(Lookback)
| where InitiatingProcessFileName =~ "WmiPrvSE.exe"
| where FileName in~ (SuspiciousChildProcesses)
| where not(ProcessCommandLine has_any (AllowlistedCmdPatterns))
| extend
ChildProcess = FileName,
ChildCmdLine = ProcessCommandLine,
AccountName = InitiatingProcessAccountName,
AccountDomain = InitiatingProcessAccountDomain,
HostName = DeviceName,
EventTime = Timestamp,
NetworkActivity = ProcessCommandLine has_any (NetworkIndicators),
CredentialActivity = ProcessCommandLine has_any (CredentialIndicators)
| project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
ChildCmdLine, NetworkActivity, CredentialActivity;
let SecEvent_Results =
SecurityEvent
| where TimeGenerated >= ago(Lookback)
| where EventID == 4688
| where ParentProcessName endswith "\\WmiPrvSE.exe"
| extend ChildProcess = tostring(split(NewProcessName, "\\")[-1])
| where ChildProcess in~ (SuspiciousChildProcesses)
| where not(CommandLine has_any (AllowlistedCmdPatterns))
| extend
ChildCmdLine = CommandLine,
AccountName = SubjectUserName,
AccountDomain = SubjectDomainName,
HostName = Computer,
EventTime = TimeGenerated,
NetworkActivity = CommandLine has_any (NetworkIndicators),
CredentialActivity = CommandLine has_any (CredentialIndicators)
| project EventTime, HostName, AccountName, AccountDomain, ChildProcess,
ChildCmdLine, NetworkActivity, CredentialActivity;
union MDE_Results, SecEvent_Results
| extend RiskScore = iif(CredentialActivity == true, 3, iif(NetworkActivity == true, 2, 1))
| sort by RiskScore desc, EventTime desc
name: WMI Spawning Suspicious Child Process (Living off the Land)
kind: Scheduled
entityMappings:
- entityType: Host
fieldMappings:
- identifier: FullName
columnName: HostName
- entityType: Account
fieldMappings:
- identifier: Name
columnName: AccountName
- identifier: NTDomain
columnName: AccountDomain
- entityType: Process
fieldMappings:
- identifier: CommandLine
columnName: ChildCmdLine
triggerOperator: gt
requiredDataConnectors:
- dataTypes:
- DeviceProcessEvents
connectorId: MicrosoftThreatProtection
- dataTypes:
- SecurityEvent
connectorId: SecurityEvents
queryFrequency: 1h
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows%20Security%20Events/Analytic%20Rules/WMI-Abuse.yaml
status: Available
queryPeriod: 1h
id: 3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f
description: |
Detects WmiPrvSE.exe (the WMI Provider Host) spawning high-risk processes
such as PowerShell, cmd.exe, cscript, or other LOLBins.
WMI requires no external tools, generates minimal disk artifacts, and can
execute code on remote systems over DCOM/RPC while bypassing many controls.
Tune AllowlistedCmdPatterns for known-safe management tools such as SCCM.
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"workspace": {
"type": "String"
}
},
"resources": [
{
"apiVersion": "2024-01-01-preview",
"id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f')]",
"properties": {
"alertRuleTemplateName": "3c8e5f0b-1d4a-4b69-9c2e-7f0d3a5e8b1f",
"customDetails": null,
"description": "Detects WmiPrvSE.exe (the WMI Provider Host) spawning high-risk processes\nsuch as PowerShell, cmd.exe, cscript, or other LOLBins.\nWMI requires no external tools, generates minimal disk artifacts, and can\nexecute code on remote systems over DCOM/RPC while bypassing many controls.\nTune AllowlistedCmdPatterns for known-safe management tools such as SCCM.\n",
"displayName": "WMI Spawning Suspicious Child Process (Living off the Land)",
"enabled": true,
"entityMappings": [
{
"entityType": "Host",
"fieldMappings": [
{
"columnName": "HostName",
"identifier": "FullName"
}
]
},
{
"entityType": "Account",
"fieldMappings": [
{
"columnName": "AccountName",
"identifier": "Name"
},
{
"columnName": "AccountDomain",
"identifier": "NTDomain"
}
]
},
{
"entityType": "Process",
"fieldMappings": [
{
"columnName": "ChildCmdLine",
"identifier": "CommandLine"
}
]
}
],
"OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Windows%20Security%20Events/Analytic%20Rules/WMI-Abuse.yaml",
"query": "let Lookback = 1h;\nlet SuspiciousChildProcesses = dynamic([\n \"powershell.exe\", \"pwsh.exe\", \"cmd.exe\", \"cscript.exe\", \"wscript.exe\",\n \"mshta.exe\", \"certutil.exe\", \"bitsadmin.exe\", \"regsvr32.exe\",\n \"rundll32.exe\", \"msiexec.exe\", \"installutil.exe\", \"cmstp.exe\",\n \"msbuild.exe\", \"wmic.exe\", \"net.exe\", \"net1.exe\", \"nltest.exe\",\n \"whoami.exe\", \"ipconfig.exe\", \"tasklist.exe\", \"schtasks.exe\",\n \"at.exe\", \"sc.exe\", \"reg.exe\"\n]);\nlet AllowlistedCmdPatterns = dynamic([\n \"ccmexec\", \"SMSAgent\", \"MOMAgent\", \"nessus\", \"qualys\"\n]);\nlet NetworkIndicators = dynamic([\n \"http://\", \"https://\", \"ftp://\", \"Net.WebClient\",\n \"DownloadString\", \"IEX\", \"Invoke-Expression\", \"/transfer\", \"-urlcache\"\n]);\nlet CredentialIndicators = dynamic([\n \"lsass\", \"mimikatz\", \"sekurlsa\", \"dump\", \"sam\", \"ntds\"\n]);\nlet MDE_Results =\n DeviceProcessEvents\n | where Timestamp >= ago(Lookback)\n | where InitiatingProcessFileName =~ \"WmiPrvSE.exe\"\n | where FileName in~ (SuspiciousChildProcesses)\n | where not(ProcessCommandLine has_any (AllowlistedCmdPatterns))\n | extend\n ChildProcess = FileName,\n ChildCmdLine = ProcessCommandLine,\n AccountName = InitiatingProcessAccountName,\n AccountDomain = InitiatingProcessAccountDomain,\n HostName = DeviceName,\n EventTime = Timestamp,\n NetworkActivity = ProcessCommandLine has_any (NetworkIndicators),\n CredentialActivity = ProcessCommandLine has_any (CredentialIndicators)\n | project EventTime, HostName, AccountName, AccountDomain, ChildProcess,\n ChildCmdLine, NetworkActivity, CredentialActivity;\nlet SecEvent_Results =\n SecurityEvent\n | where TimeGenerated >= ago(Lookback)\n | where EventID == 4688\n | where ParentProcessName endswith \"\\\\WmiPrvSE.exe\"\n | extend ChildProcess = tostring(split(NewProcessName, \"\\\\\")[-1])\n | where ChildProcess in~ (SuspiciousChildProcesses)\n | where not(CommandLine has_any (AllowlistedCmdPatterns))\n | extend\n ChildCmdLine = CommandLine,\n AccountName = SubjectUserName,\n AccountDomain = SubjectDomainName,\n HostName = Computer,\n EventTime = TimeGenerated,\n NetworkActivity = CommandLine has_any (NetworkIndicators),\n CredentialActivity = CommandLine has_any (CredentialIndicators)\n | project EventTime, HostName, AccountName, AccountDomain, ChildProcess,\n ChildCmdLine, NetworkActivity, CredentialActivity;\nunion MDE_Results, SecEvent_Results\n| extend RiskScore = iif(CredentialActivity == true, 3, iif(NetworkActivity == true, 2, 1))\n| sort by RiskScore desc, EventTime desc\n",
"queryFrequency": "PT1H",
"queryPeriod": "PT1H",
"severity": "High",
"status": "Available",
"subTechniques": [
"T1021.006",
"T1059.001",
"T1059.003",
"T1059.005"
],
"suppressionDuration": "PT1H",
"suppressionEnabled": false,
"tactics": [
"Execution",
"LateralMovement",
"Persistence"
],
"techniques": [
"T1021",
"T1047",
"T1059"
],
"templateVersion": "1.0.5",
"triggerOperator": "GreaterThan",
"triggerThreshold": 0
},
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
}
]
}