WMI Lateral Movement: WmiPrvSE.exe Spawning Interactive Shells

Ankit Mehta@Secvyn

•updated Jun 27, 2026•1•0•2

Detects instances where the WMI Provider Host process (WmiPrvSE.exe) spawns common interactive shells, scripting interpreters, or other binaries typically associated with remote command execution. This pattern is a strong indicator of WMI being abused for lateral movement or remote code execution within a Windows environment.