T1047 Windows Management Instrumentation
Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. MITRE ATT&CK
4 programs on CmdID 38 Sigma rules T1047 on attack.mitre.org
Programs for it
Sigma rules tagged with it
highHackTool - Potential Impacket Lateral Movement ActivityEcco, oscd.community, Jonhnathan Ribeiro, Tim Rauch · Windows
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) · Windows
highPotential Remote SquiblyTwo Technique ExecutionMarkus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Autorun Registry Modified via WMISwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highSuspicious Microsoft Office Child ProcessFlorian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io · Windows
highSuspicious Process Created Via Wmic.EXEFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows
highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) · Windows
mediumApplication Termination Attempt via Wmic.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumComputer System Reconnaissance Via Wmic.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumPotential Product Class Reconnaissance Via Wmic.EXEMichael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumPotential Unquoted Service Path Reconnaissance Via Wmic.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumProcess Creation Attempt via Wmic.EXEMichael Haag, Florian Roth (Nextron Systems), juju4, oscd.community · Windows
mediumRDP Enable or Disable via Win32_TerminalServiceSetting WMI ClassDaniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumRegistry Enumeration via WMI StdregprovSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumService Reconnaissance Via Wmic.EXEfrack113, Nasreddine Bencherchali (Nextron Systems) · Windows
mediumService Startup Type Change Via Wmic.EXESwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumSystem Disk And Volume Reconnaissance Via Wmic.EXEStephen Lincoln '@slincoln-aiq' (AttackIQ) · Windows
mediumWindows Hotfix Updates Reconnaissance Via Wmic.EXENasreddine Bencherchali (Nextron Systems) · Windows
mediumXSL Script Execution Via WMIC.EXETimur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel · Windows
Command lines CmdID reads as it
Show brief details about the currently running processes on the page for wmic.exe
wmic process list briefIdentifyShow full details about the currently running processes on the page for wmic.exe
wmic process list fullIdentifyAn example is here when CmdID’s reading of it names T1047: a Sigma rule it trips is tagged with it, or its abuse is documented as it.