Detectionhightest
PSExec and WMI Process Creations Block
Detects blocking of process creations originating from PSExec and WMI commands
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
Windowswindefend
ProductWindows← raw: windows
Servicewindefend← raw: windefend
Definition
Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)
Detection Logic
Detection Logic1 selector
detection:
selection:
EventID: 1121
ProcessName|endswith:
- '\wmiprvse.exe'
- '\psexesvc.exe'
condition: selectionFalse Positives
Unknown
False positive likelihood has not been assessed. Additional context may be needed during triage.
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
97b9ce1e-c5ab-11ea-87d0-0242ac130003
Status
test
Level
high
Type
Detection
Created
Tue Jul 14
Modified
Sun Dec 25
Author
Path
rules/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml
Raw Tags
attack.executionattack.lateral-movementattack.t1047attack.t1569.002