WmiPrvSE.exe

Top Paths

• C:\Windows\System32\wbem81.28%
• C:\Windows\SysWOW64\wbem18.72%

Top Hashes (SHA256)

• 25dfb8168246e5d04dd6f124c95e4c4c4e8273503569acd5452205558d09987117.97%
• 2198a7b58bccb758036b969ddae6cc2ece07565e2659a7c541a313a0492231a314.08%
• b62acacfcaf99a50149f9dce06136d478723992a61014fc3dbae81289fe219f911.93%
• 155578ce51f2bbd0b79588368653d09878eefaf8e2f5eac99a1f741d0286b72310.36%
• d17557a926c07e11fd21cc737c36e5a0e8742f3f7deb6b0c95c397605a38ed868.58%
• a75c85f3b089993e9c042fb82ecb7757e8f460ed8065fc7991caa38a6de0f50c5.42%
• ac535a3ed8a0138305e1e9d060bb3b94afe4d05a8b8506224f5df802c54a9eeb4.46%
• 20b32ebbda9de2f06e66d833b10957427631e0dc8d4f34d0203e0ffa96ce454d4.01%
• 960056479dc34a7de757813e9eb6ecc72c58ee5d5ba36151baa86201bae82f9f3.33%
• 1d7b11c9deddad4f77e5b7f01dddda04f3747e512e0aa23d39e4226854d26ca23.23%

Top Grandparents

• services.exe100%
• explorer.exe<0.01%

Top Parents

• svchost.exe100%
• cmd.exe<0.01%

Top Children

• mofcomp.exe95.5%
• cmd.exe1.97%
• powershell.exe0.73%
• WerFault.exe0.62%
• DismHost.exe0.53%
• PatchMyPC-ScriptRunner.exe0.23%
• Ccm32BitLauncher.exe0.17%
• msiexec.exe0.13%
• powercfg.exe0.04%
• wsceaa.exe0.03%

What does WmiPrvSE.exe normally do?

Located in C:\Windows\System32\wbem (64-bit) or C:\Windows\SysWOW64\wbem (32-bit). Always launched by svchost.exe (hosting the WMI service). Multiple instances may run. Common children include mofcomp.exe (MOF compilation). Low volume of child processes in normal operation.

When is WmiPrvSE.exe suspicious?

Spawning cmd.exe, powershell.exe, or other shells — this often indicates remote WMI execution from another host. Spawning reconnaissance tools (net.exe, ipconfig.exe, whoami.exe). Parent process other than svchost.exe. Running from a path outside the wbem directories. High frequency of child process creation.

How do attackers abuse WmiPrvSE.exe?

When an attacker runs wmic /node:<target> process call create on a remote machine, the target machine shows wmiprvse.exe spawning the requested process. This makes wmiprvse.exe a key indicator of lateral movement via WMI. The attacker does not need to drop tools on the target — wmiprvse.exe handles execution. This is a favored technique in advanced attacks because WMI is a legitimate, built-in, and often unmonitored channel.

Detection guidance

High-confidence: wmiprvse.exe spawning cmd.exe, powershell.exe, or other shells. This is the primary indicator of remote WMI-based execution. Correlate with network authentication events to identify the source host. Monitor Sysmon Event ID 1 for wmiprvse.exe as ParentImage with suspicious child processes. WMI activity logging: enable WMI-Activity/Operational event log for Event IDs 5857-5861.

False positive notes

WMI is used heavily by management tools — mofcomp.exe as a child is normal. Some monitoring solutions query WMI frequently, generating wmiprvse.exe activity. SCCM and other enterprise tools may trigger wmiprvse.exe child process creation as part of normal operations.

MITRE ATT&CK techniques