CmdID

CmdID / Files

WmiPrvSE.exe

WMI Provider Host file version info

Program on Windows 14 known copies with hashes 24 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WmiPrvSE.exe?

file version info and known copies
Installed inC:\Windows\system32\wbem\
C:\Windows\SysWOW64\wbem\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Provider Host

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WmiPrvSE.exe · signed by Microsoft Windows

47494c8a5807c500487aced9d786726ec3554c32d8429d6269237fa47dc0ea22

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WmiPrvSE.exe · signed by Microsoft Windows

97d33b99aab79c32fe5a9cd134824ac1b2effb89956d0817590876deed282288

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiPrvSE.exe · signed by Microsoft Windows

2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a3

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WmiPrvSE.exe · signed by Microsoft Windows

960056479dc34a7de757813e9eb6ecc72c58ee5d5ba36151baa86201bae82f9f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiPrvSE.exe · signed by Microsoft Windows

6f2499d3a5b0ebf18dedc0b4ef0bfa2d72289bf593de53ca845e7c708f8f2098

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WmiPrvSE.exe · signed by Microsoft Windows

982728faa80569eba75ea29b4795330e45faf969ae0ccb3b57914cb811263fe5

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WmiPrvSE.exe · signed by Microsoft Windows

492657ece8183337ff324f69c6b2acce51dc80ee035d45cc566255f8e6c08381

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WmiPrvSE.exe · signed by Microsoft Windows

a75c85f3b089993e9c042fb82ecb7757e8f460ed8065fc7991caa38a6de0f50c

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WmiPrvSE.exe · signed by Microsoft Windows

158075d730a7a6acbe7739251ee9bea4349268597ca576b3e0cb8442140865fd

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiPrvSE.exe · signed by Microsoft Windows

b5c78bef3883e3099f7ef844da1446db29107e5c0223b97f29e7fafab5527f15

10.0.14393.2155 (rs1_release_1.180305-1842) · C:\Windows\SysWOW64\wbem\WmiPrvSE.exe · signed by Microsoft Windows

0ef0bb79047494273b2f8b44f1080a1458def6db2828ae517380d59cb29d7291

10.0.14393.2155 (rs1_release_1.180305-1842) · C:\Windows\system32\wbem\WmiPrvSE.exe · signed by Microsoft Windows

1d7b11c9deddad4f77e5b7f01dddda04f3747e512e0aa23d39e4226854d26ca2

6.3.9600.18946 (winblue_ltsb_escrow.180302-1800) · C:\windows\system32\wbem\WmiPrvSE.exe · not signed

25dfb8168246e5d04dd6f124c95e4c4c4e8273503569acd5452205558d099871

6.3.9600.18946 (winblue_ltsb_escrow.180302-1800) · C:\windows\SysWOW64\wbem\WmiPrvSE.exe · not signed

d17557a926c07e11fd21cc737c36e5a0e8742f3f7deb6b0c95c397605a38ed86

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name WmiPrvSE.exe
highHackTool - Potential Impacket Lateral Movement ActivityEcco, oscd.community, Jonhnathan Ribeiro, Tim Rauch
highImagingDevices Unusual Parent/Child ProcessesNasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Mofcomp ExecutionNasreddine Bencherchali (Nextron Systems)
highSuspicious Autorun Registry Modified via WMISwachchhanda Shrawan Poudel (Nextron Systems)
highSuspicious WmiPrvSE Child ProcessVadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)
highWab/Wabmig Unusual Parent Or Child ProcessesNasreddine Bencherchali (Nextron Systems)
highWindows Shell/Scripting Processes Spawning Suspicious ProgramsFlorian Roth (Nextron Systems), Tim Shelton
mediumPotential WMI Lateral Movement WmiPrvSE Spawned PowerShellMarkus Neis @Karneades
mediumWmiPrvSE Spawned A ProcessRoberto Rodriguez @Cyb3rWard0g

Sigma names WmiPrvSE.exe in 24 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.