How do you detect WMI remote execution and wmiexec?

Detect WMI remote execution on the target by alerting on command interpreters, LOLBins or any process with share-redirected output whose parent is WmiPrvSE.exe, using Sysmon Event ID 1 or Security Event ID 4688 with command-line auditing. Impacket wmiexec adds a recognisable command line, cmd.exe /Q /c with output redirected to an ADMIN$ path, and a short-lived hidden file in the Windows directory. Add the WMI-Activity/Operational log (5857 provider loads, 5860 and 5861 subscriptions) and correlate with a type 3 logon and RPC traffic from the same source. Baseline endpoint-management and monitoring tools, which also spawn WmiPrvSE children.

Detecting WMI Remote Execution and wmiexec

Remote WMI execution calls Win32_Process.Create over DCOM and RPC, and the new process is a child of WmiPrvSE.exe on the target. Impacket’s wmiexec.py wraps this in a semi-interactive shell that writes command output to a file on the ADMIN$ share and reads it back over SMB. Both halves are detectable: the process tree on the target and the file traffic around it.

Signals at a Glance

Signal	Where	ATT&CK
cmd.exe or powershell.exe whose parent is WmiPrvSE.exe	Sysmon 1, Event 4688	T1047
Command line redirecting output to an ADMIN$ path (1> \\127.0.0.1\ADMIN$\__timestamp 2>&1)	Sysmon 1, Event 4688	T1047
Short-lived hidden files in the Windows directory read over SMB	Sysmon 11/23, Event 5145	T1021.002
Provider load or event consumer activity from a remote client	WMI-Activity 5857, 5861	T1047
Type 3 logon followed by DCOM/RPC traffic to port 135	Event 4624, Zeek dce_rpc	T1021.003

Process Tree on the Target

On the destination, WMI-created processes are children of WmiPrvSE.exe. That relationship is normal for a few management tools, so the signal is the child: a command interpreter, a LOLBin or anything with output redirected to a share. The wmiexec shell uses a recognisable pattern, cmd.exe /Q /c <command> 1> \\127.0.0.1\ADMIN$\__<digits> 2>&1:

// Microsoft Defender (KQL) - interpreter spawned by WmiPrvSE with share redirection
DeviceProcessEvents
| where InitiatingProcessFileName =~ "WmiPrvSE.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "mshta.exe")
| extend ShareRedirect = ProcessCommandLine matches regex @"ADMIN\$|C\$|127\.0\.0\.1"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ShareRedirect
| order by ShareRedirect desc, Timestamp desc
// tune/validate: baseline SCCM, monitoring agents and backup tools that use WMI.

The same logic in Splunk, using process-creation events with parent data (Sysmon 1 or 4688 with command-line auditing enabled):

index=sysmon EventCode=1 ParentImage="*\\WmiPrvSE.exe"
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe")
| eval share_redirect=if(match(CommandLine, "(?i)(ADMIN\$|\\\\127\.0\.0\.1)"), 1, 0)
| stats count values(CommandLine) as cmds by Computer, User, share_redirect
| sort - share_redirect, - count
# tune/validate: field names depend on your Sysmon add-on.

WMI-Activity and Network Context

The Microsoft-Windows-WMI-Activity/Operational log adds context the process tree lacks. Event 5857 records a provider being loaded, 5860 a temporary event subscription and 5861 a permanent one, which matters for persistence as much as for execution. Remote operations also show the client machine name in several of these events, which lets you tie the activity to a source host.

Enable command-line auditing (Event 4688) or Sysmon so the parent and command line exist at all; without them WMI execution is nearly invisible.
Alert on Event 5861 permanent subscriptions created outside your management tooling, since they are a persistence mechanism that rides the same service.
Pair the target-side process alert with a type 3 logon and inbound port 135 plus high-port RPC from the same source in the preceding minute.
Hunt the cleanup: wmiexec writes and then deletes a __-prefixed file, so short-lived files in the Windows directory are a useful second signal.

Vetted sources

Use the SigmaHQ WmiPrvSE child-process rules, Elastic and Splunk ESCU WMI content and MITRE CAR analytics for WMI execution. Atomic Red Team includes WMI remote-execution tests for validation, and the Sysmon configurations from SwiftOnSecurity and Olaf Hartong cover process creation. Baseline your own environment — endpoint management and monitoring platforms generate legitimate WmiPrvSE children.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Process Tree on the Target

WMI-Activity and Network Context

Build Detections That Fire

Lateral Movement Detection

Detection Hub

DCOM Lateral Movement Detection

smbexec Detection