What it does. Detects WMI-based lateral movement (e.g. wmic process call create, Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-lateral-movement-via-wmi, or copy the skill folder into ~/.claude/skills/hunting-for-lateral-movement-via-wmi/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/hunting-for-lateral-movement-via-wmi/SKILL.md

SKILL.md (verbatim)

name: hunting-for-lateral-movement-via-wmi
description: Detects WMI-based lateral movement (e.g. wmic process call create,
  Win32_Process.Create()) by analyzing Windows Event ID 4688 and Sysmon Event ID 1 for
  WmiPrvSE.exe spawning suspicious child processes like cmd.exe or powershell.exe, plus
  WMI-Activity/Operational events 5857/5860/5861 for subscription-based persistence. Use
  when hunting for remote code execution via WMI or investigating lateral movement across
  Windows hosts.
domain: cybersecurity
subdomain: threat-hunting
tags:
- threat-hunting
- lateral-movement
- wmi
- sysmon
- mitre-attack
- process-creation
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.CM-01
- DE.AE-02
- DE.AE-07
- ID.RA-05
mitre_attack:
- T1046
- T1057
- T1082
- T1083
- T1021

Hunting for Lateral Movement via WMI

Overview

Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.

When to Use

• When investigating security incidents that require hunting for lateral movement via wmi
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Windows Security Event Logs with Process Creation auditing enabled (Event 4688 with command line)
• Sysmon installed with Event ID 1 (Process Creation) configured
• Python 3.9+ with python-evtx, lxml libraries
• Understanding of WMI architecture and WmiPrvSE.exe behavior

Steps

Step 1: Parse Process Creation Events

Extract Event ID 4688 and Sysmon Event 1 entries from EVTX files.

Step 2: Detect WmiPrvSE Child Processes

Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution.

Step 3: Analyze Command Line Patterns

Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share).

Step 4: Check WMI Event Subscriptions

Parse WMI-Activity/Operational log for event consumer creation indicating persistence.

Expected Output

JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Hunting for Lateral Movement via WMI

Detection Event IDs

WMI Lateral Movement Process Chain

Source Host:                    Destination Host:
wmic.exe                  -->  WmiPrvSE.exe
  process call create            -> cmd.exe /q /c <command>
                                    -> 1> \\127.0.0.1\admin$\__<timestamp> 2>&1

Key Detection Patterns

Suspicious Child Processes of WmiPrvSE.exe

Command Line Regex Patterns

# WMI remote execution via cmd
r"cmd\.exe\s+/[qQ]\s+/[cC]"

# Output to admin$ share
r"\\\\127\.0\.0\.1\\admin\$\\__\d+"

# WMIC process creation
r"wmic\s+.*process\s+call\s+create"

Sysmon Event 1 Key Fields

WMI-Activity Log Location

%SystemRoot%\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

References

• MITRE T1047 (WMI): https://attack.mitre.org/techniques/T1047/
• MITRE T1546.003 (WMI Event Subscription): https://attack.mitre.org/techniques/T1546/003/
• Detecting WMI Lateral Movement: https://imphash.medium.com/detecting-lateral-movement-101-part-2
• JPCERT Lateral Movement: https://www.jpcert.or.jp/english/pub/sr/20170612ac-ir_research_en.pdf

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.