WMIC and CIM in Cyber Intrusions: Hunting Lateral Movement and Event Consumers

Windows Management Instrumentation (WMI) is the Microsoft implementation of Web-Based Enterprise Management (WBEM) and the Common Information Model (CIM). Designed to allow administrators to query system state, manage hardware settings, and automate administrative tasks across distributed networks, WMI provides full operational access to Windows internals. Adversaries frequently weaponize WMI for remote lateral movement, local system reconnaissance, and persistent backdoors that store code entirely in the WMI repository.

While Microsoft is deprecating the legacy wmic.exe command-line tool in favor of PowerShell CIM cmdlets, threat actors continue to abuse wmic.exe and direct WMI DCOM interfaces across enterprise environments.

Lateral movement via wmic process call create

Adversaries use wmic to initiate processes on remote systems without relying on SMB or administrative shares. A standard lateral movement command appears as:

wmic.exe /node:"192.168.1.50" /user:"DOMAIN\admin" /password:"Password123" process call create "cmd.exe /c powershell -enc ..."

When this command executes, the local machine connects to the remote endpoint over TCP port 135 (RPC Endpoint Mapper) and negotiates a dynamic high-order TCP port for DCOM communication. The remote WMI service process, WmiPrvSE.exe (WMI Provider Host), then creates the requested process.

This architecture creates a distinctive process ancestry pattern. On the remote victim machine, the spawned process (e.g., cmd.exe or powershell.exe) has `WmiPrvSE.exe` as its parent process rather than an interactive user shell. In typical enterprise operations, WmiPrvSE rarely spawns interactive shells.

Permanent WMI event subscriptions for persistence

WMI event subscriptions allow attackers to establish persistent access that survives system restarts without modifying registry run keys or scheduling standard tasks. A complete subscription consists of three interconnected classes:

• __EventFilter: A WQL query specifying when to trigger (e.g., `SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'`).
• __EventConsumer: The action to execute, typically an `CommandLineEventConsumer` running a shell command or an `ActiveScriptEventConsumer` executing VBScript/JScript stored directly in the repository.
• __FilterToConsumerBinding: A relational class linking the filter to the consumer, activating the trigger.

Because the payload code is stored inside the WMI repository file (`OBJECTS.DATA` under `C:\Windows\System32\wbem\Repository\`), no separate executable file needs to reside on disk.

Telemetry footprints: Event ID 5861 and process lineage

Monitor WMI-Activity operational logs (`Microsoft-Windows-WMI-Activity/Operational`) to capture event subscriptions and query execution. Event ID 5861 is logged whenever an `ActiveScriptEventConsumer` or `CommandLineEventConsumer` is registered or executed. The event records the consumer name, target command line, and matching filter query.

For process-level monitoring (Event ID 4688 / Sysmon Event ID 1), alert on any instance where `WmiPrvSE.exe` spawns command interpreters or scripting engines:

ParentImage: C:\Windows\System32\wbem\WmiPrvSE.exe
Image: C:\Windows\System32\cmd.exe (or powershell.exe, mshta.exe, cscript.exe)

Sigma detection for WMI spawned processes

This Sigma rule flags suspicious child processes launched by the WMI Provider Host:

title: Suspicious Child Process Spawned by WmiPrvSE
status: stable
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\WmiPrvSE.exe'
selection_children:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\mshta.exe'
- '\cscript.exe'
- '\wscript.exe'
- '\rundll32.exe'
- '\regsvr32.exe'
condition: selection_parent and selection_children

Investigation and containment steps

When investigating an alert involving WmiPrvSE spawning child processes, inspect network connections on TCP port 135 to determine the source IP address that initiated the RPC call. Inspect permanent event consumers on the endpoint using PowerShell: `Get-CimInstance -Namespace root/subscription -ClassName __EventConsumer`.

Explore our wmic LOLBin profile, check the Execute category, and review MITRE ATT&CK T1047 Windows Management Instrumentation. You can also browse our Sigma rule library for more coverage.

Further technical details are documented in Microsoft Learn WMI Architecture and MITRE ATT&CK Technique T1047.