WMI Exploitation: How Attackers Use It — And How to Detect It

Malware News
1

WMI Exploitation: How Attackers Use It — And How to Detect It

Investigating Remote Execution and Strengthening Detection Strategies

MITRE and Red Canary security researchers have identified Windows Management Instrumentation (ATT&CK Technique T1047) as a top technique most commonly used by threat actors in 2024 and 2025. It can be leveraged for Execution, Discovery, and Lateral Movement by executing commands on remote machines.

The technique primarily entails investigating the process, network, and authentication logs on an endpoint to identify potentially nefarious activity. I have captured these in Sysmon (Sysmon Config File used) and Security logs with Security Onion.

The attack was executed with Atomic Red Team’s WMI Execute Remote Process test on a Windows 11 host (hostname: flare) towards a Windows Server 2025 as the target host (hostname: win-8evlhh0merv).

Technique Execution

Artifacts

Process Activity

For WMI to execute a process as a user on a remote computer, the following arguments are passed to WMIC along with the process class and the call create method:

  • /user User
  • /password User’s password
  • /node Target computer’s IP address
  • Process to execute (command line arguments are valid to pass in)

An example execution would look like the following:

wmic /user:[DOMAIN]\[USERNAME] /password:[PASSWORD] /node:"[TARGET_IP]" process call create "[COMMAND]"

WmiPrvSE.exe, or WMI Provider Host, is the process on the target host that relays the instructions from the source host to be executed on the target. It is spawned by svchost.exe which manages the Windows services needed by a process.

Demystifying the “SVCHOST.EXE” Process and Its Command Line Options

The svchost.exe process creation event is executing the command svchost.exe -k DcomLaunch -p to load the services listed by the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch registry key. These are required by WMI to execute remote commands as a specified user.

DCOM, or Distributed Component Object Model, facilitates communication between computers and applications. Two of its dependencies, Remote Procedure Call and Local Session Manager, facilitate communication over the network and local user sessions.

Essential Windows Services: DcomLaunch / DCOM Server Process Launcher

Process Creations

DLLs Loaded

The source host loads the following DLLs:
- wbemprox.dll
- wbemcomn.dll
- wbemsvc.dll
- fastprox.dll

The target host loads one additional DLL, wmiutils.dll, to continue executing processes from WmiPrvSE.exe. Different Sysmon configuration files will be more or less verbose, showing additional DLLs loaded, but these are core to most standard configurations.

DLLs Loaded

Network Connections

WMI leverages RPC, or Remote Procedure Call, to transmit data between the WMIC application on the source and the WmiPrvSE application on the target. RPC operates over port 135 to create an initial connection with the target, followed by a higher port number, as seen in the image below.

Performing a reverse DNS lookup is often part of RPC for authentication of the target, but it is unnecessary. The source provides 10.1.168.192.in-addr.arpa — the target’s reverse DNS lookup name — to the DNS server. The DNS record type PTR maps the IP to the domain name, whereas A maps the domain name to the IP address.

After the client and server, or source and target, have verified the connection, RPC negotiates a high port (between 1024 and 65535) to execute the WMI transmission denoted by the red box in the image.

Following the execution of WMI, RPC closes the connection from the client.

Network Connections

Authentication

WMI remote execution is accomplished via a network logon on the target host to capture the credentials of the target user to execute a remote process as that user. A type 3 logon indicates a network logon.

The Elevated Token and Impersonation Level fields indicate that the machine account on the target host can pass Administrator credentials to the source host.

The Elevated Token of %%1842 indicates the machine account logged in with Administrator privileges, while the Impersonation Level of %%1833 — “delegate” — allows the machine account to pass credentials to any domain-joined computer.

The source host then logs in as Administrator using explicit credentials, denoted by event ID 4648, meaning it is providing the username and password that was passed to it by the target’s machine account.

Authentication Events

Detection and Analysis Opportunities

Now, we dive into what matters most to defenders after understanding how WMI works to build high-fidelity detections for suspicious activity. Suspicious WMI detection is most effectively accomplished with process creation and image load events.

First, searching for WmiPrvSE as a parent process identifies what tools are being run on the target host. This will yield significant hits on cmd.exe as a child process — too many to create a detection for — so focusing on the execution of other native Windows tools will have better results, such as:

  • Scripting and DLL usage (powershell, pwsh, mshta, rundll32)
  • Scheduled Tasks and Services (sc, at, schtasks)
  • Registry (reg)
  • System info (tasklist, ipconfig, hostname, whoami, systeminfo, net)
  • CMD executing native Windows tools (cmd.exe /c whoami)

Secondly, remote command execution requires the DLLs mentioned in the above section, but defense evasion and credential theft may involve other DLLs. Detecting WMIC or WmiPrvSE loading unexpected or atypical DLLs can uncover more stealthy living-off-the-land techniques.

The verbosity of logs is highly dependent on the Sysmon configuration file, requiring tuning to your environment.

The following example SIEM query based on the Kibana Query Language can be used to guide rule creation in your environment:

(process.parent.name: WmiPrvSE.exe and process.name: (powershell.exe or pwsh.exe or mshta.exe or rundll32.exe or sc.exe or at.exe or schtasks.exe or reg.exe or tasklist.exe or ipconfig.exe or hostname.exe or whoami.exe or systeminfo.exe or net.exe))
or
(process.name: (WMIC.exe or WmiPrvSE.exe) and not dll.name: (fastprox.dll or wbemcomn.dll or wbemprox.dll or wbemsvc.dll or wmiutils.dll))
or
(process.name: WMIC.exe and process: "*process call create*")

Connect with me on LinkedIn and follow updates on my GitHub! Contributions and recommendations are welcome.

WMI Exploitation: How Attackers Use It — And How to Detect It was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: WMI Exploitation: How Attackers Use It — And How to Detect It | by Logan Flecke | Mar, 2025 | Detect FYI