WMI Command Execution via CommandLine

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•1

This rule detects suspicious command-line activity indicative of Windows Management Instrumentation (WMI) being used for command execution. It specifically looks for `SecurityEvent` with `EventID 4688` (a process creation event) where the `CommandLine` contains keywords associated with WMI operations like `wmic process call create`, `wmic service`, `wmic os`, or `Get-WmiObject`, combined with selection or filtering keywords such as `select`, `where`, or `-ComputerName`. The rule triggers if three or more such events occur within an hour from the same computer and user.