Detectionhightest

Suspicious WmiPrvSE Child Process

Detects suspicious and uncommon child processes of WmiPrvSE

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)Created Mon Aug 23Updated Fri Nov 108a582fe2-0882-4b89-a82a-da6b2dc32937windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic6 selectors
detection:
    selection_parent:
        ParentImage|endswith: '\wbem\WmiPrvSE.exe'
    selection_children_1:
        # TODO: Add more LOLBINs or suspicious processes that make sens in your environment
        Image|endswith:
            - '\certutil.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\verclsid.exe'
            - '\wscript.exe'
    selection_children_2:
        # This is in a separate selection due to the nature of FP generated with CMD
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - 'cscript'
            - 'mshta'
            - 'powershell'
            - 'pwsh'
            - 'regsvr32'
            - 'rundll32'
            - 'wscript'
    filter_main_werfault:
        Image|endswith: '\WerFault.exe'
    filter_main_wmiprvse:
        Image|endswith: '\WmiPrvSE.exe' # In some legitimate case WmiPrvSE was seen spawning itself
    filter_main_msiexec:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains: '/i '
    condition: selection_parent and 1 of selection_children_* and not 1 of filter_main_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

Rule Metadata
Rule ID
8a582fe2-0882-4b89-a82a-da6b2dc32937
Status
test
Level
high
Type
Detection
Created
Mon Aug 23
Modified
Fri Nov 10
Path
rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml
Raw Tags
attack.executionattack.defense-evasionattack.t1047attack.t1204.002attack.t1218.010
View on GitHub