High RiskWindowsLegitimateCommonly Abused
wmiprvse.exeSYSTEM PROCESSwmiprvse.exe - WMI Provider Host Security Analysis
wmiprvse.exe (WMI Provider Host) executes WMI queries and hosts WMI providers. It is abused for **lateral movement, persistence via event subscriptions, and fileless attacks**. WMI-based attacks are difficult to detect without proper logging.
Risk Summary
HIGH priority. WMI is used for lateral movement and persistence. Monitor WMI event subscriptions, process creation via Win32_Process.Create, and wmiprvse.exe child processes.
Overview
What is wmiprvse.exe?
wmiprvse.exe hosts WMI providers and processes WMI queries.
Security Significance
- Remote Execution: WMI allows remote code execution
- Persistence: Event subscriptions survive reboots
- Lateral Movement: Standard Windows feature for remote management
- Fileless Attacks: Executes code without files on disk
Normal Behavior
Normal Behavior
| Property | Expected Value |
|---|---|
| Path | C:\Windows\System32\wbem\wmiprvse.exe |
| Parent | svchost.exe (Winmgmt) |
| Instances | Multiple (provider isolation) |
| User | NETWORK SERVICE or SYSTEM |
Common Locations
C:\Windows\System32\wbem\wmiprvse.exeSuspicious Indicators
Suspicious Indicators
| Indicator | Risk |
|---|---|
| Path not in wbem folder | CRITICAL |
| Parent not svchost.exe | CRITICAL |
| Spawning PowerShell/cmd | HIGH |
| Network to unusual destinations | HIGH |
| New WMI event subscriptions | HIGH |
Abuse Techniques
Attack Techniques
WMI Process Creation
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList "malware.exe"
WMI Event Subscription Persistence
$Filter = New-CimInstance -ClassName __EventFilter...
$Consumer = New-CimInstance -ClassName CommandLineEventConsumer...
Lateral Movement
wmic /node:TARGET process call create "malware.exe"
Detection Guidance
Detection
Enable WMI Logging
- WMI-Activity Operational log (Event ID 5857-5861)
Detection Rules
wmiprvse.exe spawning interpreters → ALERT
New WMI event subscription → ALERT
Remote WMI connections → MONITOR
Remediation Steps
Remediation
- Remove malicious WMI subscriptions
- Block remote WMI if not needed
- Enable WMI logging
- Monitor WMI activity
Investigation Checklist
- Verify path is System32\wbem
- Check WMI event subscriptions
- Review WMI-Activity logs
- Check for remote WMI connections
- Examine child processes
MITRE ATT&CK Techniques
Last verified: January 18, 2026