Techniques › T1047 › AN1031
AN1031 Analytic 1031
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects adversarial abuse of WMI to execute local or remote commands via WMIC, PowerShell, or COM API through a multi-event chain: process creation, command execution, and corresponding network connection if remote.</p>
- Detects
- T1047 Windows Management Instrumentation
- Part of
- DET0364 Behavioral Detection Strategy for WMI Execution Abuse on Windows
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| WinEventLog:WMI | EventCode=5857, 5858, 5860, 5861 | DC0008 WMI Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
WMIQueryScope | Restrict detection scope to suspicious WMI namespaces like `\root\cimv2`, `\root\subscription`. |
TimeWindow | Set maximum allowable time window to correlate WMI process creation and remote connections. |
UserContext | Tune based on interactive vs. system-level execution (e.g., via SYSTEM or low-privileged users). |
RemoteDestinationThreshold | Number of unique remote hosts contacted using WMI within a time window. |
SuspiciousCommandPatterns | Regex patterns to identify adversary-like usage (e.g., `wmic process call`, `powershell Invoke-WmiMethod`). |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2021-40539 | Zoho ManageEngine | Mapped |
| CVE-2021-44077 | Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | Mapped |