WmiPrvSE Spawned A Process

Title: WmiPrvSE Spawned A Process
Status: stable
Description:Detects WmiPrvSE spawning a process
References:
  -https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-15
modified:2023-03-23
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    ParentImage|endswith: '\WmiPrvSe.exe'
  filter_logonid:
    LogonId:
      -'0x3e7'
      -'null'

  filter_system_user:
    User|contains:
      -'AUTHORI'
      -'AUTORI'

  filter_wmiprvse:
    Image|endswith: '\WmiPrvSE.exe'
  filter_werfault:
    Image|endswith: '\WerFault.exe'
  filter_null:
    LogonId: 'None'
  condition:selection and not 1 of filter_*
Falsepositives:
  -False positives are expected (e.g. in environments where WinRM is used legitimately)
Level: medium