WMI DCOM RPC Lateral Movement - IWbemServices Remote Process Creation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

Detects remote execution of WMI commands over DCOM by identifying the specific IWbemServices UUID (8BC3F05E-D86B-11D0-A075-00C04FB68820) in RPC traffic. The rule triggers on inbound TCP traffic on port 135 where the payload size exceeds 500 bytes, which is consistent with the initiation of WMI remote process creation.