Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1047

Windows Management Instrumentation

Execution 90 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Web Shell Detection: Script Process Child of Common Web Processes production 2026-10-23
splunk Possible Lateral Movement PowerShell Spawn production 2026-10-09
splunk Remote Process Instantiation via WMI production 2026-10-09
splunk Process Execution via WMI production 2026-10-09
splunk PowerShell Invoke CIMMethod CIMSession production 2026-10-09
splunk Impacket Lateral Movement WMIExec Commandline Parameters production 2026-10-09
splunk WMI Temporary Event Subscription deprecated 2026-10-05
splunk Windows WMI Reconnaissance Class Query production 2026-10-02
splunk Windows WMI Process Call Create production 2026-10-02
splunk Remote WMI Command Attempt production 2026-10-02
elastic Suspicious Managed Code Hosting Process production 2026-09-18
elastic Windows Script Interpreter Executing Process via WMI production 2026-09-18
elastic Volume Shadow Copy Deletion via WMIC production 2026-09-18
elastic Volume Shadow Copy Deletion via PowerShell production 2026-09-18
elastic Suspicious WMI Image Load from MS Office production 2026-09-18
elastic Suspicious Cmd Execution via WMI production 2026-09-18
elastic Mofcomp Activity production 2026-09-18
elastic Enumeration Command Spawned via WMIPrvSE production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Suspicious WMIC XSL Script Execution production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Microsoft Build Engine Started by a System Process production 2026-09-18
elastic Suspicious .NET Code Compilation production 2026-09-18
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic Persistence via WMI Standard Registry Provider production 2026-09-18
elastic Persistence via WMI Event Subscription production 2026-09-18
elastic WMI Incoming Lateral Movement production 2026-09-18
splunk Windows WMI Impersonate Token production 2026-09-08
sigma WMI Module Loaded By Uncommon Process test 2026-06-29
sigma Registry Manipulation via WMI Stdregprov experimental 2026-06-19
sigma Registry Enumeration via WMI Stdregprov experimental 2026-06-19
splunk Wmiprvse LOLBAS Execution Process Spawn production 2026-05-13
splunk Windows WMI Process And Service List production 2026-05-13
splunk Windows WinRAR Launched Outside Default Installation Directory production 2026-05-13
splunk Script Execution via WMI production 2026-05-13
splunk Remote Process Instantiation via WMI and PowerShell Script Block production 2026-05-13
splunk Remote Process Instantiation via WMI and PowerShell production 2026-05-13
splunk PowerShell Invoke WmiExec Usage production 2026-05-13
splunk Impacket Lateral Movement smbexec CommandLine Parameters production 2026-05-13
splunk Impacket Lateral Movement Commandline Parameters production 2026-05-13
sigma Service Startup Type Change Via Wmic.EXE experimental 2026-04-27
sigma Potential Remote SquiblyTwo Technique Execution test 2026-01-24
sigma XSL Script Execution Via WMIC.EXE test 2026-01-24
sigma Service Reconnaissance Via Wmic.EXE test 2026-01-07
sigma Potential Process Reconnaissance via Wmic.EXE test 2025-12-15
sigma Potential Product Reconnaissance Via Wmic.EXE test 2025-12-15
sigma RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class experimental 2025-11-15
sigma WMIC Remote Command Execution test 2025-10-22
sigma System Disk And Volume Reconnaissance Via Wmic.EXE test 2025-10-20
sigma Password Set to Never Expire via WMI experimental 2025-07-30
sigma Potential Product Class Reconnaissance Via Wmic.EXE test 2025-03-17
sigma Suspicious Autorun Registry Modified via WMI experimental 2025-02-17
sigma Application Removed Via Wmic.EXE test 2024-07-02
sigma Successful Account Login Via WMI stable 2024-01-17
sigma WMI Event Consumer Created Named Pipe test 2023-11-30
sigma Suspicious WmiPrvSE Child Process test 2023-11-10
sigma HackTool - CrackMapExec Execution Patterns stable 2023-11-06
sigma Application Termination Attempt via Wmic.EXE test 2023-09-11
sigma Potential Unquoted Service Path Reconnaissance Via Wmic.EXE test 2023-09-11
sigma Blue Mockingbird - Registry test 2023-08-17
sigma Suspicious Microsoft Office Child Process test 2023-04-24
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell stable 2023-03-29
sigma WmiPrvSE Spawned A Process stable 2023-03-23
sigma Wmiexec Default Output File test 2023-03-08
sigma HackTool - CrackMapExec Execution test 2023-03-08
sigma HackTool - Potential Impacket Lateral Movement Activity stable 2023-02-21
sigma Potential Windows Defender Tampering Via Wmic.EXE test 2023-02-14
sigma Hardware Model Reconnaissance Via Wmic.EXE test 2023-02-14
sigma Windows Hotfix Updates Reconnaissance Via Wmic.EXE test 2023-02-14
sigma Suspicious Process Created Via Wmic.EXE test 2023-02-14
sigma Computer System Reconnaissance Via Wmic.EXE test 2023-02-14
sigma Process Creation Attempt via Wmic.EXE test 2023-02-14
sigma Service Started/Stopped Via Wmic.EXE test 2023-02-14
sigma Suspicious WMIC Execution Via Office Process test 2023-02-14
sigma Potential Maze Ransomware Activity test 2023-02-13
sigma PSExec and WMI Process Creations Block test 2022-12-25
sigma WMImplant Hack Tool test 2022-12-25
sigma Wmiprvse Wbemcomn DLL Hijack - File test 2022-12-02
sigma WMIC Unquoted Services Path Lookup - PowerShell test 2022-11-25
sigma Blue Mockingbird test 2022-10-09
sigma UNC2452 PowerShell Pattern test 2022-10-09
sigma Suspicious Encoded Scripts in a WMI Consumer test 2022-10-09
sigma Wmiprvse Wbemcomn DLL Hijack test 2022-10-09
sigma Script Event Consumer Spawning Process test 2022-07-14
sigma T1047 Wmiprvse Wbemcomn DLL Hijack test 2022-02-24
sigma Remote DCOM/WMI Lateral Movement test 2022-01-01
sigma MITRE BZAR Indicators for Execution test 2021-11-27