Hunting for Lateral Movement via WMI
FreeDetect WMI-based lateral movement in Windows environments.
Free · Opens the source repo
What Hunting for Lateral Movement via WMI does
This skill focuses on detecting lateral movement in Windows environments by leveraging Windows Management Instrumentation (WMI). It specifically targets the misuse of WMI through commands such as wmic process call create or Win32_Process.Create(), which are often used by attackers to execute commands on remote systems. By analyzing key event logs, including Windows Security Event ID 4688 and Sysmon Event ID 1, the skill identifies instances where WmiPrvSE.exe spawns suspicious child processes like cmd.exe or powershell.exe. Additionally, it examines WMI-Activity/Operational events for signs of subscription-based persistence, which is a common tactic employed by attackers to maintain access.
The skill is designed for security analysts and incident responders who need to investigate potential security breaches or validate their monitoring capabilities against known attack techniques. It provides a structured approach to threat hunting by parsing relevant event logs and flagging suspicious activity associated with WMI. The output is a comprehensive JSON report that details WMI-spawned processes, identifies suspicious command lines, and alerts on WMI event subscriptions, creating a timeline of lateral movement activity.
To effectively utilize this skill, users must have the necessary prerequisites in place, including enabled Windows Security Event Logs and Sysmon configurations. A solid understanding of WMI architecture and the behavior of WmiPrvSE.exe will also enhance the effectiveness of the analysis. This skill is particularly useful for building detection rules or queries tailored to identify WMI-based lateral movement, making it an essential tool for proactive security measures.
When to use it
Use this skill when investigating security incidents related to lateral movement via WMI, or when creating detection rules for such activities.
When not to use it
This skill is not suitable for environments without Windows or for scenarios where WMI is not being used for lateral movement.
What you can build with it
Investigating Security Incidents
Use this skill to analyze logs when investigating potential security breaches involving lateral movement.
Building Detection Rules
Leverage this skill to create and refine detection rules for identifying WMI-based attacks in your environment.
Validating Security Monitoring Coverage
Employ this skill to assess and validate your security monitoring capabilities against known WMI attack techniques.
How to install Hunting for Lateral Movement via WMI
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-lateral-movement-via-wmi --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for Lateral Movement via WMI
Overview
Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.
When to Use
- When investigating security incidents that require hunting for lateral movement via wmi
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Windows Security Event Logs with Process Creation auditing enabled (Event 4688 with command line)
- Sysmon installed with Event ID 1 (Process Creation) configured
- Python 3.9+ with
python-evtx,lxmllibraries - Understanding of WMI architecture and WmiPrvSE.exe behavior
Steps
Step 1: Parse Process Creation Events
Extract Event ID 4688 and Sysmon Event 1 entries from EVTX files.
Step 2: Detect WmiPrvSE Child Processes
Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution.
Step 3: Analyze Command Line Patterns
Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share).
Step 4: Check WMI Event Subscriptions
Parse WMI-Activity/Operational log for event consumer creation indicating persistence.
Expected Output
JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.
Frequently asked questions about Hunting for Lateral Movement via WMI
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.