← LeaderboardThe Skill Leaderboard

hunting-for-lateral-movement-via-wmi

Detects WMI-based lateral movement (e.g. wmic process call create, Win32_Process.Create()) by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for WmiPrvSE.exe spawning suspicious child processes like cmd.exe or powershell.exe, plus WMI-Activity/Operational events 5857/5860/5861 for subscription-based persistence. Use when hunting for remote code execution via WMI or investigating lateral movement across Windows hosts.

Published by mukul975 ↗mukul975/Anthropic-Cybersecurity-Skills

Try your first task

hunting-for-lateral-movement-via-wmi

Start a fresh conversation. Replace the highlighted placeholders.

Use hunting-for-lateral-movement-via-wmi to analyze [authorized Windows EVTX files] for WMI-based lateral movement and persistence, using Event 4688 command lines, Sysmon Event 1, and WMI-Activity events where available; provide findings and detection recommendations.

Required inputs

  • [authorized Windows EVTX files]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

name: hunting-for-lateral-movement-via-wmidescription: Detects WMI-based lateral movement (e.g. wmic process call create,  Win32_Process.Create()) by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for  WmiPrvSE.exe spawning suspicious child processes like cmd.exe or powershell.exe, plus  WMI-Activity/Operational events 5857/5860/5861 for subscription-based persistence. Use  when hunting for remote code execution via WMI or investigating lateral movement across  Windows hosts.domain: cybersecuritysubdomain: threat-huntingtags: - threat-hunting- lateral-movement- wmi- sysmon- mitre-attack- process-creationversion: '1.0'author: mahipallicense: Apache-2.0nist_csf: - DE.CM-01- DE.AE-02- DE.AE-07- ID.RA-05mitre_attack: - T1046- T1057- T1082- T1083- T1021

Hunting for Lateral Movement via WMI

Overview

Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.

When to Use

  • When investigating security incidents that require hunting for lateral movement via wmi
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Windows Security Event Logs with Process Creation auditing enabled (Event 4688 with command line)
  • Sysmon installed with Event ID 1 (Process Creation) configured
  • Python 3.9+ with python-evtx, lxml libraries
  • Understanding of WMI architecture and WmiPrvSE.exe behavior

Steps

Step 1: Parse Process Creation Events

Extract Event ID 4688 and Sysmon Event 1 entries from EVTX files.

Step 2: Detect WmiPrvSE Child Processes

Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution.

Step 3: Analyze Command Line Patterns

Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share).

Step 4: Check WMI Event Subscriptions

Parse WMI-Activity/Operational log for event consumer creation indicating persistence.

Expected Output

JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.

hunting-for-lateral-movement-via-wmi by mukul975 · The Skill Leaderboard