Windows Management Instrumentation

What is Windows Management Instrumentation?

“Windows Management Instrumentation is documented as technique T1047 in MITRE ATT&CK® v19.1 under the Execution tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Windows Management Instrumentation activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for WMI process execution through wmiprvse.exe spawning child processes, as legitimate WMI operations rarely require spawning command interpreters or network utilities as direct children of the WMI provider host.

2. 2

   Alert on WMI permanent event subscriptions being created or modified, particularly EventFilter, EventConsumer, and FilterToConsumerBinding classes, which are the components of WMI-based persistence mechanisms.

3. 3

   Detect remote WMI execution by monitoring for DCOM-based connections to port 135 followed by dynamic high port connections between internal hosts, combined with process creation events on the target system.

4. 4

   Monitor PowerShell Invoke-WMIMethod and Get-WMIObject cmdlets used with ComputerName parameters specifying remote hosts, as these are commonly used for WMI-based lateral movement and remote execution.

5. 5

   Correlate WMI activity with network connections and file system events, as attackers using WMI for execution typically download and execute payloads that generate secondary indicators detectable through endpoint telemetry.

Example Alerts

These realistic alert examples show what Windows Management Instrumentation looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Windows Management Instrumentation?

Detection centers on XDR, SIEM telemetry for the execution phase of the attack. Monitor for WMI process execution through wmiprvse.exe spawning child processes, as legitimate WMI operations rarely require spawning command interpreters or network utilities as direct children of the WMI provider host. Alert on WMI permanent event subscriptions being created or modified, particularly EventFilter, EventConsumer, and FilterToConsumerBinding classes, which are the components of WMI-based persistence mechanisms.

What does a Windows Management Instrumentation alert look like?

A representative XDR detection is "WMI Used to Execute Payload on Remote Systems" (critical severity): WMI process wmiprvse.exe spawned cmd.exe on 15 systems within 6 minutes, each executing the same Base64-encoded PowerShell command that downloads and runs a remote access tool. The WMI execution was initiated remotely using domain administrator credentials from a compromised server. This WMI-based lateral execution leaves fewer artifacts than PSExec and evades many endpoint security tools.

Which tools detect Windows Management Instrumentation, and how can I practice?

Windows Management Instrumentation (T1047) is best surfaced with XDR, SIEM telemetry, which exposes the execution signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.