The Detection Gap: MITRE ATT&CK T1047

This Detection Gap post details how Windows Management Instrumentation (WMI) is frequently abused for execution, lateral movement, and persistence; it contrasts legitimate administrative use with malicious patterns, highlights a high-confidence IOC (a fresh remote logon followed by wmiprvse.exe spawning a suspicious child), and recommends correlating logon and process creation events or using tools such as Symantec Threat Tracer to speed detection.