Microsoft Defender ASR Rule Blocked PSExec/WMI Process Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•19

Detects when Microsoft Defender for Endpoint blocks process creations originating from PSExec or WMI commands. This rule specifically looks for Event ID 1121 (Attack Surface Reduction rule blocked action) where the process name ends with 'wmiprvse.exe' (WMI Provider Host) or 'psexesvc.exe' (PsExec service). This indicates that an ASR rule designed to prevent execution via these methods has been triggered and successfully blocked the action.