This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe

Hunt Hypothesis

This detection identifies adversaries leveraging Windows Management Instrumentation (WMI) to execute rundll32.exe via the Win32_Process event, a common technique for establishing persistence and evading traditional process monitoring by masquerading as legitimate system activity. Proactively hunting for this behavior in Azure Sentinel is critical because WMI-based process spawning often bypasses standard execution logs, allowing attackers to silently deploy malicious payloads like wmi_rundll.exe that could serve as a foothold for lateral movement or further compromise.

YARA Rule

rule iKAT_wmi_rundll {
	meta:
		description = "This exe will attempt to use WMI to Call the Win32_Process event to spawn rundll - file wmi_rundll.exe"
		author = "Florian Roth"
		date = "05.11.14"
		score = 65
		reference = "http://ikat.ha.cked.net/Windows/functions/ikatfiles.html"
		hash = "97c4d4e6a644eed5aa12437805e39213e494d120"
	strings:
		$s0 = "This operating system is not supported." fullword ascii
		$s1 = "Error!" fullword ascii
		$s2 = "Win32 only!" fullword ascii
		$s3 = "COMCTL32.dll" fullword ascii
		$s4 = "[LordPE]" ascii
		$s5 = "CRTDLL.dll" fullword ascii
		$s6 = "VBScript" fullword ascii
		$s7 = "CoUninitialize" fullword ascii
	condition:
		all of them and filesize < 15KB
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 8 string patterns in its detection logic.

References

• http://ikat.ha.cked.net/Windows/functions/ikatfiles.html
• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the WMI Win32_Process spawning rundll32.exe detection rule, along with targeted exclusion strategies:

• Microsoft Endpoint Configuration Manager (SCCM) Software Updates

  • Scenario: The SCCM Client (ccmexec.exe) frequently uses WMI to query system state and triggers the installation or configuration of software updates. During this process, it often invokes rundll32.exe via the Win32_Process.Create method to load specific update agent DLLs (e.g., WUAUENG.DLL).
  • Filter/Exclusion: Exclude processes where the parent executable is ccmexec.exe and the spawned command line contains keywords like “SoftwareCenter” or “WindowsUpdate”.
    • Logic: ParentImageName = 'ccmexec.exe' AND CommandLine CONTAINS 'rundll32.exe'.

• Group Policy Client Service (gpupdate) Scheduled Tasks

  • Scenario: The Group Policy client (gpsvc) or the scheduled task “UserPolicy” often runs during logon or system startup. It utilizes WMI to enforce policy settings, which can trigger a Win32_Process call to spawn rundll32.exe for processing specific policy extensions (such as printer mapping scripts or security compliance checks).
  • Filter/Exclusion: Create an exclusion for the parent process gpsvc.exe or specifically target scheduled tasks named “UserPolicy” and “MachinePolicy”.
    • Logic: ParentImageName IN ('gpsvc.exe', 'svchost.exe') AND ParentCommandLine CONTAINS 'gpupdate'.

• Microsoft Defender for Endpoint (MDE) Real-Time Protection Scans

  • Scenario: The Microsoft Defender service (MsMpEng.exe) or its helper