The Detection Gap: MITRE ATT&CK T1047

Welcome to the Detection Gap, a breakdown for security practitioners who have to make quick calls under tight time constraints. In each post, we walk through what one MITRE ATT&CK technique looks like when it's legitimate activity vs. when it's actually an attacker in your environment. 

• WMI isn't a single-purpose tool for attackers. The same infrastructure can execute commands, gather intelligence, move laterally, and persist across reboots.
• The legacy WMIC command-line tool is being fully removed from Windows 11 as of the August 2026 update, but WMI itself (the actual infrastructure attackers abuse) isn't going anywhere.
• A single WMI-spawned process rarely tells the whole story. It's the process it spawns, paired with the remote logon that got it there, that separates routine administration from an attacker moving through your network.

Some things you just can’t block 

Windows Management Instrumentation (WMI) is one of those Windows components defenders have no choice but to live with. Your patching tools use it. Your inventory systems use it. Even your monitoring and remote administration tools use it. And that's exactly why it's one of the most consistently abused pieces of infrastructure in the entire ATT&CK framework.

It isn't limited to one job either. The same WMI access an attacker gets can be used to execute commands on a remote system, gather intelligence to map out a network, move laterally machine to machine, and with event subscriptions, give them a way to survive a reboot. 

Threat groups from APT29 to Scattered Spider have all leaned on it. Not because it's exotic, but because it's already there, trusted, and rarely questioned.

There’s a Windows change worth knowing about, too. The legacy wmic.exe command-line tool is being removed from Windows 11, following a multi-year deprecation that started with Windows 10. But don't mistake its removal for the end of WMI itself. Only the old command-line interface is being retired. WMI itself, the actual infrastructure this technique abuses, remains supported and accessible through PowerShell's Invoke-WmiMethod and Get-CimInstance cmdlets, or directly through COM APIs. 

If anything, the shift toward PowerShell as the primary interface means the malicious command lines you're watching for are evolving too, not disappearing.

The legitimate case

For most defenders, the hardest part of WMI is knowing and understanding what normal WMI activity looks like in their environment. Because it carries an enormous amount of real, everyday enterprise administration, there’s a lot of ways activity can be legitimate. 

A normal chain looks like this:

• Source: An admin workstation, a jump box, or a recognized RMM platform, using an account authorized for remote management 
• Remote access path: DCOM over port 135 or WinRM over 5985/5986, consistent with your management tooling
• Resulting activity: spawns a process tied to a known task, such as patch deployment, inventory collection, or a remote service restart (something with a documented business reason)
• Timing and scope: Activity follows an expected schedule or maintenance window, and stays within a defined set of managed assets, no sprawling or unplanned sweeps

Essentially, if you can explain why WMI was used, you’re almost certainly in the clear.

The malicious case

Now, take away that explanation. 

A workstation that normally doesn’t administer anything remotely suddenly starts connecting to another endpoint. A valid account logs on. wmiprvse.exe starts a process. But there’s no good reason why. 

On their own they might not scream attacker, but together the picture changes:

• Source: A workstation or server that has no business initiating remote administration, especially one that was recently involved with suspicious activity
• Command line: Classic WMIC-era syntax such as process call create targeting a remote node, or its PowerShell equivalent through Invoke-WmiMethod (often paired with a /node: argument pointing to an external IP) targeting an unexpected internal system
• Resulting activity: wmiprvse.exe spawns a script host, an encoded command, a binary planted somewhere temporary that has no operational reason to exist
• Timing and correlation: A remote interactive logon lands on the destination host immediately beforehand, followed almost immediately by wmiprvse.exe spawning that child process

That specific pairing, a fresh remote logon followed by a WMI-spawned process with no ticket behind it, is one of the highest-confidence lateral movement patterns defenders have. And it’s precisely how you spot abnormal WMI activity, catching an attacker right in their tracks. 

Where the signal comes together

Manually, this investigation means correlating two separate event types that live in different places: the remote logon event on the destination host, and the subsequent process creation tied to wmiprvse.exe. For the longest time, analysts have had to pull both, line them up by timestamp, and manually decide whether the pairing looks like routine administration or an attacker's next hop. 

That kind of hands-on correlation work easily eats up real investigation time, especially across an environment with constant legitimate remote administration. A powerful capability built into Symantec® CBX and Carbon Black Cloud is Threat Tracer, which streamlines and enhances threat investigations by analyzing and visually revealing the broader web of relationships between entities, like devices, users, processes and files, that are either involved in or affected by an attack.

Instead of tedious, manual correlations, Threat Tracer assembles every clue into a visual narrative. Analysts can see the remote logon and the resulting wmiprvse.exe child process connected in the same chain. Just like that the work shifts from reconstructing the sequence to deciding whether that sequence belongs in the first place, a most significant change when it comes to WMI. While the infrastructure itself remains neutral, the chain around it reveals the truth. 

What to look for in Threat Tracer

Start with the logon that preceded the WMI activity. 

A known admin source, tied to a service account with a defined, limited scope, reads very differently from a logon originating somewhere unexpected, especially if that host has already shown up in other suspicious activity recently. 

Then look at what wmiprvse.exe actually spawned. A patch deployment or inventory task will have a recognizable, repeatable shape across your fleet. A script host, an encoded command, or a process reaching out somewhere new won’t. If you can see the command line process call create unusual Invoke-WmiMethod parameters, or targeting that doesn’t fit the host’s normal management pattern, it’s worth slowing down. More so when there's no maintenance window or ticket to explain why they're happening.

A quick posture check

Before you close out, consider these questions about your own environment.

1. Do you know which accounts and source hosts are authorized to initiate remote WMI activity in your environment, well enough to rule out an unauthorized source quickly?
2. If a remote logon were immediately followed by an unexplained wmiprvse.exe child process tomorrow, would that correlation surface for you automatically, or would you need to build it by hand?
3. Are you watching for WMI event subscriptions at all, given it's one of the more persistent, reboot-surviving footholds this very infrastructure enables?

That third question is worth a longer think. 

Lateral movement gets attackers to the next machine. Persistence is how they stay there. WMI can do both. That’s exactly why it’s worth as understanding as more than just another narrow ATT&CK technique. 

Next up, we'll look at another ATT&CK technique using the same approach: what's normal, what's not, and what tool can help you make that distinction faster.

When WMI looks normal, context is what matters. See how Symantec CBX helps your analysts understand that context faster. Reach out for a 1:1 demo.