MITRE ATT&CK KQL Explorer

697 techniques · 102 KQL queries · 71 with detections

Has KQL

T1047Windows Management Instrumentation

Execution

View on MITRE ATT&CK →

1 Query

WMIC Remote Command Execution with Target IP

mediumproductionDefender XDR

Microsoft Defender for Endpoint·DeviceProcessEvents

let IPRegex = '[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}';
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "WMIC.exe"
| extend RemoteIP = extract(IPRegex, 0, ProcessCommandLine)
| where isnotempty(RemoteIP)
| where RemoteIP != "127.0.0.1"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, RemoteIP, InitiatingProcessFileName
| sort by Timestamp desc

Bert-JanP (adapted) · last tested 2025-03-01

attack.mitre.org
github.com
lolbas-project.github.io

Tuning notes

SCCM and enterprise management tools use WMIC remotely. Exclude known management server IPs and service accounts.

+ Add another query for this technique →