Hunting Rituals #4: Threat hunting for execution via Windows Management Instrumentation

The report outlines practical hunting methodologies for detecting WMI (T1047) execution abuse, highlighting EDR queries targeting wmic.exe command patterns and processes spawned by WmiPrvSe.exe, along with techniques to reduce noise via user/context filters and environment-specific statistics. It emphasizes identifying lateral movement and persistence via WMI and recommends balancing simple hypotheses with broader, noisier searches to improve detection coverage.