WMI remote execution

Windows Management Instrumentation runs payloads on remote hosts

categoryNetwork and infrastructure attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: wmiexec

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1047 · WMI Execute Local Process · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1047 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1047 -TestGuids b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 -TimeoutSeconds 120'

ATT&CK T1047 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1047 -Tool atomic -RunId run-2026-10-14-016 -Command 'Invoke-AtomicTest T1047 -TestGuids b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 -TimeoutSeconds 120'

ATT&CK T1047 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1047 -Tool atomic -RunId run-2026-10-18-017 -Command 'Invoke-AtomicTest T1047 -TestGuids b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-27 · detected in 65s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	WMI process creation via wmic: `wmic process call create` -- WMI execution / lateral movement (T1047)
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
… and 5 more event type(s)

Detection that fired

✓ Wazuh 100407 (level 10) lab rule — WMI process creation via wmic: `wmic process call create` -- WMI execution / lateral movement (T1047)

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~68132 incidental alerts/hour — tune against this.

detected windows · 2026-10-27 · detected in 63s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	WMI process creation via wmic: `wmic process call create` -- WMI execution / lateral movement (T1047)
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4103
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
… and 6 more event type(s)

Detection that fired

✓ Wazuh 100407 (level 10) lab rule — WMI process creation via wmic: `wmic process call create` -- WMI execution / lateral movement (T1047)

Plus 13 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~69537 incidental alerts/hour — tune against this.

Classification

25 values: 15 reviewed, 3 lab-measured, 6 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Network attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Medium
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	AvailabilityConfidentialityIntegrity
Platform	Windows
Environment	On-premises
Target asset class	EndpointServer
Kill-chain phase (tactic)	Execution
Remote support	No

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Network Connection CreationProcess CreationWMI Creation

Detection & response

Mitigated by 21

M1018 attack-mitigation
M1026 attack-mitigation
M1038 attack-mitigation
M1040 attack-mitigation
D3-ANAA d3fend
D3-APCA d3fend
D3-CAA d3fend
D3-CSPP d3fend
D3-EAL d3fend
D3-EDL d3fend
D3-HBPI d3fend
D3-NTCD d3fend
D3-NTF d3fend
D3-NTSA d3fend
D3-PHDURA d3fend
D3-PMAD d3fend
D3-PSA d3fend
D3-RTSD d3fend
D3-SCA d3fend
D3-SCF d3fend
D3-UGLPA d3fend

Detected by 54

DET0364 attack-detection-strategy
058f4380-962d-40a5-afce-50207d36d7e2 sigma
05c36dd6-79d6-4a9a-97da-3db20298ab2d sigma
09658312-bc27-4a3b-91c5-e49ab9046d1b sigma
0b7163dc-7eee-4960-af17-c0cd517f92da sigma
10c14723-61c7-4c75-92ca-9af245723ad2 sigma
15434e33-5027-4914-88d5-3d4145ec25a9 sigma
221b251a-357a-49a9-920a-271802777cc0 sigma
29fd07fc-9cfd-4331-b7fd-cc18dfa21052 sigma
3c89a1e8-0fba-449e-8f1b-8409d6267ec8 sigma
3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d sigma
42a993dd-bb3e-48c8-b372-4d6684c4106c sigma
438025f9-5856-4663-83f7-52f878a70a50 sigma
493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb sigma
49d9671b-0a0a-4c09-8280-d215bfd30662 sigma
4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d sigma
51cbac1e-eee3-4a90-b1b7-358efb81fa0a sigma
526be59f-a573-4eea-b5f7-f0973207634d sigma
52cad028-0ff0-4854-8f67-d25dfcbc78b4 sigma
5af54681-df95-4c26-854f-2565e13cfab0 sigma
614a7e17-5643-4d89-b6fe-f9df1a79641c sigma
671bb7e3-a020-4824-a00e-2ee5b55f385e sigma
68050b10-e477-4377-a99b-3721b422d6ef sigma
68bcd73b-37ef-49cb-95fc-edc809730be6 sigma
692f0bec-83ba-4d04-af7e-e884a96059b6 sigma
76f55eaa-d27f-4213-9d45-7b0e4b60bbae sigma
7707a579-e0d8-4886-a853-ce47e4575aaa sigma
7773b877-5abb-4a3e-b9c9-fd0369b59b00 sigma
7864a175-3654-4824-9f0d-f0da18ab27c0 sigma
8028c2c3-e25a-46e3-827f-bbb5abf181d7 sigma
83844185-1c5b-45bc-bcf3-b5bf3084ca5b sigma
8a582fe2-0882-4b89-a82a-da6b2dc32937 sigma
8d5aca11-22b3-4f22-b7ba-90e60533e1fb sigma
8d63dadf-b91b-4187-87b6-34a1114577ea sigma
92b0b372-a939-44ed-a11b-5136cf680e27 sigma
97b9ce1e-c5ab-11ea-87d0-0242ac130003 sigma
9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f sigma
a0e417e2-2fa1-40da-b6d2-e094cd5e1191 sigma
b53317a0-8acf-4fd1-8de8-a5401e776b96 sigma
b640c0b8-87f8-4daa-aef8-95a24261dd1d sigma
… and 14 more in the database

Tested by 12

00738d2a-4651-4d76-adf2-c43a41dfb243 atomic
0fd48ef7-d890-4e93-a533-f7dedd5191d3 atomic
10447c83-fc38-462a-a936-5102363b1c43 atomic
5750aa16-0e59-4410-8b9a-8a47ca2788e2 atomic
718aebaa-d0e0-471a-8241-c5afa69c7414 atomic
778b54b0-ae7a-4f80-b74b-59eddee87ad5 atomic
7db7a7f9-9531-4840-9b30-46220135441c atomic
9c8ef159-c666-472f-9874-90c8d60d136b atomic
a3ddaf15-d1a1-4bc3-8683-84c7c67120fe atomic
b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 atomic
c107778c-dcf5-47c5-af2e-1d058a3df3ea atomic
c510d25b-1667-467d-8331-a56d3e9bc4ff atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-016`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-017`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-002`	detected	atomic	windows	2026-10-27
`run-2026-10-27-011`	detected	atomic	windows	2026-10-27

run-2026-10-14-016 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=12). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1047 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=13 max_level=15 dwell_s=90
run-2026-10-18-017 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=12). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1047 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1505 max_level=15 dwell_s=90
run-2026-10-27-002 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=12). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1047 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1835 max_level=15 dwell_s=90
run-2026-10-27-011 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=12). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1047 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=1 incidental=1779 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1047/
attack: T1047 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 200 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 147 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-016 (partially-detected) for T1047: no alert matched the expected technique
ev-0004 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-017 (partially-detected) for T1047: no alert matched the expected technique
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-002 (detected): Wazuh rule(s) 100407 fired on T1047 within the detonation window
WMI process creation via wmic: `wmic process call create` -- WMI execution / lateral movement (T1047)
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-011 (detected): Wazuh rule(s) 100407 fired on T1047 within the detonation window
WMI process creation via wmic: `wmic process call create` -- WMI execution / lateral movement (T1047)