WMIC Process Creation

Use case development / Detect Malware Infections / Detect Malware Execution

sigma

Detection rule

title: WMIC Process Execution
status: experimental
description: Detects process creation via WMIC command
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'process call create'
  condition: selection
falsepositives:
  - Legitimate admin scripts
level: medium
tags:
  - attack.execution
  - attack.t1047

Test cases

• Create process using WMIC

False positive guidance

Baseline WMIC usage by admin accounts.

Detection course