WMI Lateral Movement - Suspicious Child Process from WmiPrvSE or wmic

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) or command-line tool (wmic.exe) initiates potentially suspicious child processes, often indicative of lateral movement or remote command execution via WMI.