Windows Management Instrumentation (WMI) and the Distributed Component Object Model (DCOM) are legitimate Windows management frameworks that attackers abuse for fileless lateral movement, remote code execution, and persistent event-driven backdoors. WMI is particularly powerful for attackers because it requires no new binary on the target system — commands execute via the built-in WmiPrvSE.exe host process.
Key data sources: DeviceProcessEvents (WmiPrvSE.exe parent, wmic.exe command lines), DeviceNetworkEvents (wmic.exe / WmiPrvSE.exe outbound on TCP 135 / dynamic RPC ports), DeviceEvents (WMI subscription creation — __EventFilter, __EventConsumer binding).
☰ Table of Contents
01 — BACKGROUND
TECHNIQUE OVERVIEWWMI allows remote process execution, event subscription persistence, and system reconnaissance — all via authenticated RPC connections that most firewalls allow on internal networks. DCOM (Distributed COM) extends COM objects across the network, enabling attackers to invoke arbitrary COM interfaces on remote hosts. Both techniques leave minimal forensic artefacts compared to PSExec or RDP — no files are dropped, no services installed, execution happens inside trusted Windows processes.
| Field | Value |
|---|---|
| MITRE Techniques | T1047 — Windows Management Instrumentation T1021.003 — Remote Services: Distributed Component Object Model |
| Kill-chain Phase | Lateral Movement, Execution, Persistence |
| Primary Log Source | DeviceProcessEvents (WmiPrvSE.exe parent), DeviceNetworkEvents |
| Secondary Log Sources | DeviceEvents (WMI subscription), SecurityEvent 4648 (explicit DCOM credential use), Microsoft-Windows-WMI-Activity/Operational (Event 5857/5858/5861) |
| Common Tools | wmic.exe (built-in), impacket wmiexec, SharpWMI, CrackMapExec --wmiexec, Cobalt Strike WMI lateral movement |
| Default Severity | SEV2 for WMI exec; SEV1 if WMI subscription detected (persistence mechanism) |
A WMI event subscription (ActiveScriptEventConsumer or CommandLineEventConsumer binding) is a persistent backdoor that survives reboots. Treat any confirmed WMI subscription created outside a known software deployment as SEV1 persistence.
02 — IDENTIFICATION
2 INDICATORSWmiPrvSE.exe (WMI Provider Host) is the Windows process that executes WMI queries and operations. When an attacker executes a remote command via WMI, WmiPrvSE.exe spawns that command as a child process. Seeing WmiPrvSE.exe as the parent of cmd.exe, powershell.exe, or any shell interpreter is the definitive indicator of WMI-based execution — either local via malicious script or remote via wmic/impacket.
- 1Run the KQL query below in Advanced Hunting. Set time range to Last 1 hour for active incidents; extend to 7 days for threat hunting.
- 2For each result, click the DeviceName link to open the Device page, then navigate to Device Timeline to trace the full execution chain leading to the WMI event.
- 3Check ProcessCommandLine of the child process — encoded commands, download cradles, or reverse shell patterns indicate malicious WMI execution vs legitimate management scripts.
- 4Identify the source host initiating remote WMI: query DeviceNetworkEvents on the affected host to find inbound TCP 135 (RPC endpoint mapper) connections and correlate the source IP to another device in the fleet.
- 5Check whether
scrcons.exe(ActiveScriptEventConsumer) appears in the process tree — this confirms WMI subscription-based persistence, which survives reboots.
| Indicator | Meaning | Severity |
|---|---|---|
| WmiPrvSE.exe → cmd.exe / powershell.exe | WMI process execution — remote or local command running via WMI | HIGH |
| wmic.exe /node:<IP> process call create | Remote WMI execution targeting another host | CRITICAL |
| scrcons.exe | WMI ActiveScriptEventConsumer — persistent WMI backdoor executing VBScript/JScript | CRITICAL |
| WmiPrvSE.exe → mshta.exe / wscript.exe | WMI executing HTA or Windows Script — LOLBin WMI chain | HIGH |
| mmc.exe network connection inbound | MMC20.Application DCOM lateral movement — mmc.exe receiving DCOM call | HIGH |
| impacket / wmiexec strings in command line | Open-source WMI lateral movement framework detected | CRITICAL |
WMI event subscriptions are a fileless, registry-less persistence mechanism. An attacker creates a __EventFilter (trigger condition), an ActiveScriptEventConsumer or CommandLineEventConsumer (action), and a __FilterToConsumerBinding (links them). This survives reboots and runs as SYSTEM. DCOM lateral movement via COM objects like MMC20.Application, ShellWindows, or ShellBrowserWindow executes code on remote hosts using the standard DCOM port (TCP 135 + dynamic RPC).
- 1On the Device Timeline, filter the event type to WmiActivityEventConsumer-Trace or search for
scrcons.exein the process column. - 2Run the WMI subscription detection KQL below in Advanced Hunting to look for __EventFilter creation across the fleet.
- 3For DCOM: query DeviceNetworkEvents for inbound connections to mmc.exe or dllhost.exe from remote IPs, which indicates DCOM invocation (MMC20.Application CLSID: 49B2791A-B1AE-4C90-9B8E-E860BA07F889).
- 4For impacket wmiexec: look for
cmd.exe /Q /cpatterns with output redirection to\\127.0.0.1\ADMIN$\__— a distinctive impacket wmiexec artefact. - 5Check the Windows WMI-Activity event log (Microsoft-Windows-WMI-Activity/Operational, Event 5857/5858/5861) for provider load errors or subscription binding events that are not present in MDE telemetry.
| Indicator / Pattern | Meaning | Severity |
|---|---|---|
| __EventFilter + __FilterToConsumerBinding created | WMI subscription persistence — survives reboot, runs as SYSTEM | CRITICAL |
| scrcons.exe execution | ActiveScriptEventConsumer fired — VBScript/JScript WMI backdoor triggered | CRITICAL |
| cmd.exe /Q /c ... \\127.0.0.1\ADMIN$\__ | impacket wmiexec output redirect pattern — confirms use of open-source WMI framework | CRITICAL |
| dllhost.exe inbound network connection | DCOM server process receiving remote invocation — potential DCOM lateral movement | HIGH |
| mmc.exe → cmd.exe (from remote caller) | MMC20.Application DCOM lateral movement — mmc spawning shell via DCOM call | HIGH |
WMI subscriptions persist in the WMI repository (C:\Windows\System32\wbem\Repository). After eradication, validate removal by querying: Get-WMIObject -Namespace root\subscription -Class __EventFilter and __EventConsumer. Both should return empty for a clean system.
03 — CONTAINMENT
IMMEDIATE ACTION- 1Isolate both the source host (where wmic /node: was executed) and the target host (where WmiPrvSE.exe spawned the shell) via MDE: Assets → Devices → [Device] → Actions → Isolate Device.
- 2Via Live Response on the target, remove any WMI subscriptions:
Get-WMIObject -Namespace root\subscription -Class __EventFilter | Remove-WMIObjectandGet-WMIObject -Namespace root\subscription -Class __EventConsumer | Remove-WMIObject. - 3Block lateral WMI at the firewall: create a host-based firewall rule blocking inbound TCP 135 (RPC) from any host not in the approved management VLAN/subnet.
- 4Check all devices that received inbound TCP 135 connections from the source host in the last 48 hours — lateral movement may have spread to multiple targets.
- 5Revoke credentials used in the WMI lateral movement — force password reset for any domain account involved.
04 — ERADICATION
CLEANUP- 1Enumerate all WMI subscriptions across the fleet: run the KQL query targeting DeviceEvents for WmiActivityEventConsumerTrace across the last 7 days to identify all affected hosts.
- 2Remove subscriptions via Live Response or on-device: query and delete
__EventFilter,__EventConsumer, and__FilterToConsumerBindingobjects in root\subscription namespace. - 3Trace back to the initial access point — WMI lateral movement typically originates from an already-compromised endpoint. Identify patient zero via DeviceLogonEvents and DeviceNetworkEvents.
- 4Assess credential exposure — WMI lateral movement with pass-the-hash requires no plaintext credentials, so any domain account that has authenticated to the source host is a potential pivot credential. Audit and reset.
- 5Harden WMI access: restrict DCOM permissions via Component Services (dcomcnfg) — remove remote launch and activation rights from non-admin groups on sensitive hosts.
05 — ESCALATION
ESCALATION PATHS| Condition | Severity | Action | Notify |
|---|---|---|---|
| WMI subscription (scrcons.exe) confirmed | SEV1 | Isolate, delete subscription, fleet-wide hunt | SOC Lead → CISO |
| impacket wmiexec pattern confirmed | SEV1 | Isolate source + target, credential reset, scope assessment | SOC Lead → CISO |
| wmic /node: lateral movement to multiple hosts | SEV1 | Contain all affected hosts, escalate to IR | SOC Lead → CISO → IR Team |
| Single WmiPrvSE.exe shell spawn (unconfirmed) | SEV2 | Investigate, verify source, prepare isolation | SOC Lead |
| SCCM / documented RMM tool | FP | Whitelist, document, close | L3 Analyst |
Stay Threat-Ready
Follow CyberHawk Threat Intel for daily SOC analyst playbooks, detection engineering guides, and threat intelligence.