Successful Account Login Via WMI

Title: Successful Account Login Via WMI
Status: stable
Description:Detects successful logon attempts performed with WMI
References:
  -Internal Research
Author: Thomas Patzke
Date: 2019-12-04
modified:2024-01-17
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4624'
    ProcessName|endswith: '\WmiPrvSE.exe'
  condition:selection
Falsepositives:
  -Monitoring tools
  -Legitimate system administration
Level: low