WMI Lateral Movement - wmiprvse.exe Spawning Scripting Interpreter

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•3

This rule detects when the WMI provider host process (wmiprvse.exe) spawns common scripting interpreters or command-line shells such as cmd.exe, powershell.exe, or wscript.exe. This behavior is a common indicator of remote command execution via WMI, often used by adversaries for lateral movement, remote code execution, or persistence within a Windows environment.