How to defend against remote execution through services and WMI

What the attacker does

With valid administrator credentials, an attacker runs a command on another machine without an interactive logon. The common routes create a service on the target (PsExec, SMBExec) or ask WMI to start a process (WMIExec, Covenant's SharpWMI). The credentials come from an earlier step; this technique is how one compromised machine turns into many.

What it looks like in the logs

On the target machine, the remote command starts a new process whose parent gives the method away. A service-based tool runs under services.exe; a WMI call runs under the provider host WmiPrvSE.exe. This is one of the starts in the recordings:

PsExec is a special case: it copies its own service, PSEXESVC.exe, which services.exe then starts, and the real command runs as a child of that. The encoded PowerShell started under services.exe is a service that a framework created only to run one command.

Detect

Measured on the challenge data: the rule caught 5 of 5 attack events and matched 2 of 2,233 normal events.

title: Command shell or payload started by services.exe, or any child of the WMI provider host
id: e5fbef58-568c-4cfb-bead-f8cfd9b1da09
status: test
description: >
  Detects remote execution landing on a host: a command shell or PsExec service started by
  services.exe, a binary that services.exe started from a user-writable folder, and any process
  started by WmiPrvSE.exe. Normal services started by services.exe are signed programs in Windows
  or Program Files, which this rule does not match.
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://howdefend.com/defend/remote-execution-service-wmi/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.lateral-movement
  - attack.execution
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
logsource:
  product: windows
  category: process_creation
detection:
  service_shell:
    ParentImage|endswith: '\services.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\PSEXESVC.exe'
  service_userpath:
    ParentImage|endswith: '\services.exe'
    Image|contains:
      - '\users\'
      - '\appdata\'
      - '\programdata\'
      - '\temp\'
      - '\public\'
  wmi_child:
    ParentImage|endswith: '\WmiPrvSE.exe'
  condition: service_shell or service_userpath or wmi_child
falsepositives:
  - A management agent that runs scripts through WMI; filter it by its own image path
  - Windows Defender runs its engine (MsMpEng.exe, NisSrv.exe) from ProgramData under services.exe; filter it by that path
level: high

What the rule misses

• A dropped binary run as a service. If the created service points straight at the attacker's executable with a plain path outside the user folders, neither branch matches. Watch new service creation (System Event ID 7045, Security Event ID 4697) as well.
• WMI that starts nothing. Not every WMI abuse creates a process: a WMI event subscription stores its payload in the WMI repository, and remote WMI can read or write data without WmiPrvSE.exe spawning a child.
• Software that runs as a service from ProgramData. The user-folder branch is the loose part of the rule: on the clean Windows 10 client it matches Windows Defender, which runs MsMpEng.exe and NisSrv.exe from ProgramData under services.exe. Those two are the only false positives here; filter them by their path.
• Legitimate remote administration. A management product that runs scripts through WMI or a service produces the same events. Filter it by its own image path, not by turning the rule off.

Prevent

• Attack surface reduction. Microsoft Defender's rule Block process creations originating from PsExec and WMI commands (d1e49aac-8f56-4280-b9ba-993a6d77406c) stops these starts. Microsoft warns not to enable it through Configuration Manager, whose client relies on WMI.
• Limit local administrators. Every route here needs administrator rights on the target. Unique local administrator passwords (LAPS) stop one stolen password from opening every machine.
• Segment the network. Remote service and WMI calls use SMB (445) and RPC; restricting workstation-to-workstation traffic removes the path these tools take.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1021.002 SMB/Windows Admin Shares
• Microsoft Learn: Attack surface reduction rules reference
• OTRF Security-Datasets (attack recordings used on this page)