high Sigma Windows

Remote Process Creation via WMI Win32_Process

WmiPrvSE.exe spawning a child is the server side of wmic process call create. The parent relationship is the detection; the command line is context.

Rule source

wmi-process-call-create.yml

title: Remote Process Creation via WMI Win32_Process
id: b71e4c30-98aa-42d5-8c6f-1d5390ab77e2
status: stable
description: >
  WmiPrvSE.exe spawning a child process is the server side of a
  "wmic /node: process call create" or Invoke-WmiMethod execution. The parent
  relationship is the signal - the child command line is only context.
references:
  - https://attack.mitre.org/techniques/T1047/
author: DetectionOps
date: 2026/09/08
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: '\WmiPrvSE.exe'
  filter_known_children:
    Image|endswith:
      - '\WerFault.exe'
      - '\wmiadap.exe'
      - '\wmiprvse.exe'
  filter_sccm_agent:
    Image|startswith: 'C:\Windows\CCM\'
  condition: selection and not 1 of filter_*
fields:
  - Image
  - CommandLine
  - User
  - ComputerName
falsepositives:
  - Configuration management agents that legitimately execute through WMI
  - Monitoring suites collecting inventory via Win32 providers
level: high
tags:
  - attack.execution
  - attack.t1047

Required telemetry

Sysmon - Event ID 1 (process creation)

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Configuration management agents that execute through WMI by design
Inventory and monitoring suites querying Win32 providers

Validation

Atomic Red Team T1047-3, executed from a second host against a lab member server

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.