Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

WMI Spawning Suspicious Child Process (Living off the Land)

Detects WmiPrvSE.exe (the WMI Provider Host) spawning high-risk processes such as PowerShell, cmd.exe, cscript, or other LOLBins. WMI requires no external tools, generates minimal disk artifacts, and can execute code on remote systems over DCOM/RPC while bypassing many controls. Tune AllowlistedCmdPatterns for known-safe management tools such as SCCM.

ATT&CK coverage

Execution

T1047Windows Management Instrumentation 94 detections cover this technique
T1059Command and Scripting Interpreter

Lateral Movement

T1021Remote Services
- T1021.006Windows Remote Management 25 detections cover this technique

Detection requirements

Log source product: microsoftthreatprotection securityevents
Log source service: deviceprocessevents securityevent

What the source says

Tagged by the source as

ExecutionLateralMovementPersistence

Detection catalogue

WMI Spawning Suspicious Child Process (Living off the Land)

ATT&CK coverage

Detection requirements

What the source says

Tagged by the source as

Detection logic

WMI Spawning Suspicious Child Process (Living off the Land)

ATT&CK coverage

Detection requirements

What the source says

Tagged by the source as

Detection logic