skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-lateral-movement-via-wmi

Detect WMI-based lateral movement by analyzing Windows Event 4688 and Sysmon process creation logs.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#windows#lateral movement#sysmon#WMI#event 4688
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-lateral-movement-via-wmi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-lateral-movement-via-wmi
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-lateral-movement-via-wmi
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-lateral-movement-via-wmi

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, lxml.

What problem does it solve?

Attackers abuse Windows Management Instrumentation (WMI) to execute commands on remote hosts and establish persistence, and these actions blend into legitimate administrative traffic. This Skill gives SOC analysts a structured hunting procedure to surface WmiPrvSE.exe child processes, suspicious command lines, and WMI event subscription persistence from Windows event logs.

Core Features & Use Cases

  • Process Creation Analysis: Parse Windows Security Event ID 4688 and Sysmon Event ID 1 to flag processes spawned by WmiPrvSE.exe, indicating remote WMI execution.
  • Command Line Inspection: Identify suspicious patterns such as cmd.exe /q /c and output redirection to admin$ shares typical of lateral movement.
  • Persistence Detection: Examine WMI-Activity/Operational events (5857, 5860, 5861) and Sysmon EID 19/20/21 for malicious event filter and consumer subscriptions.
  • Use Case: During incident response, an analyst runs this hunt across collected EVTX files to produce a JSON report of WMI-spawned processes, subscription alerts, and a lateral movement timeline mapped to MITRE ATT&CK T1047 and T1546.003.

Quick Start

Hunt for WMI-based lateral movement in the collected Windows Security and Sysmon EVTX logs and generate a JSON report of suspicious WmiPrvSE child processes and event subscriptions.

Frequently Asked Questions about hunting-for-lateral-movement-via-wmi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect WMI lateral movement in Windows event logs?▼

Detect WMI lateral movement by hunting for WmiPrvSE.exe spawning child processes like cmd.exe or powershell.exe in Windows Security Event ID 4688 and Sysmon Event ID 1. Also check for suspicious command lines such as cmd.exe /q /c with output redirected to admin$ shares.

What Sysmon event IDs detect WMI persistence?▼

Sysmon Event IDs 19, 20, and 21 detect WMI event subscription persistence: EID 19 logs __EventFilter creation, EID 20 logs __EventConsumer creation, and EID 21 logs __FilterToConsumerBinding. Without these enabled, WMI persistence (T1546.003) is invisible even if execution is logged.

What tools are needed to parse Windows EVTX files for threat hunting?▼

This hunt requires Python 3.9+ with the python-evtx and lxml libraries to parse EVTX files. You also need Windows Security logs with process creation auditing (Event 4688 with command line) and Sysmon configured for Event ID 1.

Why does WMI detection miss some lateral movement activity?▼

Rules keyed only on WmiPrvSE.exe child processes miss script-based consumers running under scrcons.exe and consumers that only write files or registry keys. Detection must also cover WMI-Activity/Operational events 5857, 5860, and 5861 for full coverage.

How do I reduce false positives in WMI lateral movement detection?▼

Reduce false positives by baselining legitimate WMI usage from SCCM, vulnerability scanners, and monitoring agents by source host, account, and binding name. Validate the hunt with Atomic Red Team T1047 tests to confirm detection fires on real attack behavior.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

hunting-for-webshell-activity

Detect webshell deployments by analyzing process creation, network, and web access logs.

Official
Advanced
Yamato-SecurityYamato-Security
26

investigate_jp

Analyze Hayabusa CSV logs to generate Japanese intrusion timelines and incident reports.

Official
Advanced
yaklangyaklang
1.6k

windows-lateral-movement

Pivot between Windows hosts using remote execution and credential techniques.

Official
Advanced
riparinoriparino
1

defensive-file-upload

Detect webshell uploads using YARA, Sigma, and KQL queries.

Community
Advanced