Sigma rule: WMI Module Loaded By Uncommon Process

Rule

Title

WMI Module Loaded By Uncommon Process

Status

test

Level

low

Author

Roberto Rodriguez @Cyb3rWard0g

Date

2019-08-10

Modified

2026-06-29

File

rules-threat-hunting/windows/image_load/image_load_wmi_module_load_by_uncommon_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects WMI modules being loaded by an uncommon process

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded|endswith:
        - '\fastprox.dll'
        - '\wbemcomn.dll'
        - '\wbemprox.dll'
        - '\wbemsvc.dll'
        - '\WmiApRpl.dll'
        - '\wmiclnt.dll'
        - '\WMINet_Utils.dll'
        - '\wmiprov.dll'
        - '\wmiutils.dll'
filter_main_generic:
    Image|contains:
        - ':\Program Files (x86)\'
        - ':\Program Files\'
        - ':\Windows\explorer.exe'
        - ':\Windows\Microsoft.NET\Framework\'
        - ':\Windows\Microsoft.NET\FrameworkArm\'
        - ':\Windows\Microsoft.NET\FrameworkArm64\'
        - ':\Windows\Microsoft.NET\Framework64\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
filter_optional_other:
    Image|endswith:
        - '\WindowsAzureGuestAgent.exe'
        - '\WaAppAgent.exe'
filter_optional_thor:
    Image|endswith:
        - '\thor.exe'
        - '\thor64.exe'
filter_optional_defender:
    Image|endswith: '\MsMpEng.exe'
filter_optional_teams:
    Image|contains:
        - '\Microsoft\Teams\current\Teams.exe'
        - '\Microsoft\Teams\Update.exe'
filter_optional_sysmon:
    Image|endswith:
        - ':\Windows\Sysmon.exe'
        - ':\Windows\Sysmon64.exe'
        - ':\Windows\Sysmon64a.exe'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1047
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1047

References

• https://threathunterplaybook.com/hunts/windows/190811-WMIModuleLoad/notebook.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/windows/image_load/image_load_wmi_module_load_by_uncommon_process.yml