How do I install the Hunting For Lateral Movement Via Wmi skill?

Run npx skillmds add theheavenlyd3mon/hunting-for-lateral-movement-via-wmi in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hunting For Lateral Movement Via Wmi safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hunting For Lateral Movement Via Wmi?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hunting For Lateral Movement Via Wmi free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Hunting For Lateral Movement Via Wmi?

theheavenlyd3mon (@theheavenlyd3mon) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hunting For Lateral Movement Via Wmi by theheavenlyd3mon

Name: Hunting For Lateral Movement Via Wmi
Rating: 4.666666666666667 (3 reviews)
Author: theheavenlyd3mon

Hunting For Lateral Movement Via Wmi

Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.

theheavenlyd3mon 8aa4ed0 4 files · 23.6 KB Updated Sep 9, 2026 28 repo stars

File contents

Hunting for Lateral Movement via WMI

Overview

Windows Management Instrumentation (WMI) is commonly abused for lateral movement via wmic process call create or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence.

When to Use

When investigating security incidents that require hunting for lateral movement via wmi
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Windows Security Event Logs with Process Creation auditing enabled (Event 4688 with command line)
Sysmon installed with Event ID 1 (Process Creation) configured
Python 3.9+ with python-evtx, lxml libraries
Understanding of WMI architecture and WmiPrvSE.exe behavior

Steps

Step 1: Parse Process Creation Events

Extract Event ID 4688 and Sysmon Event 1 entries from EVTX files.

Step 2: Detect WmiPrvSE Child Processes

Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution.

Step 3: Analyze Command Line Patterns

Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share).

Step 4: Check WMI Event Subscriptions

Parse WMI-Activity/Operational log for event consumer creation indicating persistence.

Expected Output

JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.

---name: hunting-for-lateral-movement-via-wmidescription: Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for WmiPrvSE.exe child process patterns, remote process execution, and WMI event subscription persistence.license: Apache-2.0---# Hunting for Lateral Movement via WMI ## Overview Windows Management Instrumentation (WMI) is commonly abused for lateral movement via `wmic process call create` or Win32_Process.Create() to execute commands on remote hosts. Detection focuses on identifying WmiPrvSE.exe spawning child processes (cmd.exe, powershell.exe) in Windows Security Event ID 4688 and Sysmon Event ID 1 logs, along with WMI-Activity/Operational events (5857, 5860, 5861) for event subscription persistence. ## When to Use - When investigating security incidents that require hunting for lateral movement via wmi - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Windows Security Event Logs with Process Creation auditing enabled (Event 4688 with command line) - Sysmon installed with Event ID 1 (Process Creation) configured - Python 3.9+ with `python-evtx`, `lxml` libraries - Understanding of WMI architecture and WmiPrvSE.exe behavior ## Steps ### Step 1: Parse Process Creation Events Extract Event ID 4688 and Sysmon Event 1 entries from EVTX files. ### Step 2: Detect WmiPrvSE Child Processes Flag processes where ParentImage/ParentProcessName is WmiPrvSE.exe, indicating remote WMI execution. ### Step 3: Analyze Command Line Patterns Identify suspicious command lines matching WMI lateral movement patterns (cmd.exe /q /c, output redirection to admin$ share). ### Step 4: Check WMI Event Subscriptions Parse WMI-Activity/Operational log for event consumer creation indicating persistence. ## Expected Output JSON report with WMI-spawned processes, suspicious command lines, WMI event subscription alerts, and timeline of lateral movement activity.

Frequently asked questions