Hunting WMI, PsExec, and Remote Execution: Where Admin Tools Turn Malicious

Every one of the tools covered in this piece is genuinely, legitimately used by IT operations teams every single day. That’s exactly what makes hunting their malicious use one of the harder discrimination problems in this entire series—you’re not looking for the presence of PsExec or WMI, which will always be present in any reasonably-sized enterprise environment. You’re looking for the specific combination of who, when, how much, and against what, that separates routine administration from an attacker moving through your network with the same tools your own IT team relies on.

PsExec and Its Behavioral Fingerprint

PsExec, a legitimate Sysinternals tool for remote execution, works by installing a temporary service on the target host, executing the specified command, and then removing that service. This specific mechanical pattern—a service installation, immediately followed by execution, immediately followed by service removal, all within a tight window—is genuinely somewhat distinctive and worth building dedicated hunt logic around rather than just watching for the PsExec binary name, since attackers frequently rename the binary specifically to avoid simple name-based detection.

A hunt hypothesis worth building: monitor for the service creation-execution-removal pattern itself (Event IDs 7045 for creation and subsequent removal events) rather than relying on the executable name, since this behavioral fingerprint survives renaming in a way that simple process name matching doesn’t. Say an attacker renames the PsExec binary to something innocuous—the underlying service lifecycle pattern it creates on the target host remains essentially identical to the legitimate tool’s behavior, which is exactly the more durable signal worth hunting for.

WMI-Based Remote Execution: Quieter Than PsExec

WMI, beyond its persistence use covered earlier in this series, is also a common remote execution mechanism, and it has a real advantage for attackers over PsExec specifically because it doesn’t require installing and removing a service on the target host, leaving less of the distinctive artifact trail PsExec creates. This makes WMI-based remote execution genuinely harder to hunt for through the service-lifecycle approach that works well for PsExec.

A hunt hypothesis worth building instead: monitor for WMI process creation events (where a process on a remote host was launched via WMI rather than through a normal local logon or standard remote execution mechanism) correlated against the account performing the launch and whether that account’s normal behavior includes this kind of remote WMI usage. Since legitimate WMI-based remote administration tends to be used by a fairly specific, identifiable set of IT automation accounts and tools, an unfamiliar account performing WMI-based remote process launches is a meaningfully stronger signal than the same activity from an account known to use this mechanism routinely.

Remote PowerShell and PowerShell Remoting Sessions

PowerShell remoting (Enter-PSSession, Invoke-Command) provides another legitimate, commonly-used remote execution path, and it deserves its own specific hunting attention distinct from the local PowerShell hunting covered in the earlier execution-focused piece. A hunt hypothesis worth building: monitor for PowerShell remoting session establishment events, specifically looking at the volume and breadth of target hosts a single account establishes sessions against within a short window, since legitimate administrative use tends to target a consistent, predictable set of hosts relevant to a specific administrator’s actual responsibilities, while lateral movement activity tends to show broader, less consistent targeting as an attacker tests access across multiple hosts.

Scheduled Task Creation as a Remote Execution Vector

Beyond its persistence role, remotely creating a scheduled task on a target host is itself a viable remote execution technique, sometimes preferred specifically because scheduled task creation can be accomplished through several different native mechanisms, giving an attacker multiple paths to achieve the same effect if one is being monitored more closely than another. A hunt hypothesis worth building: correlate scheduled task creation events with the originating session’s source, specifically flagging task creation where the creating session originated from a remote host rather than a local logon, cross-referenced against whether that specific remote administration pattern matches your organization’s documented, approved administrative workflows.

Establishing a Baseline of Approved Remote Administration Tooling

Given how much of this hunting category depends on distinguishing approved from unapproved use of legitimate tools, the single highest-leverage preparatory step is building and maintaining an accurate inventory of which remote execution tools and accounts your IT operations team actually, legitimately uses, and through which specific mechanisms. Say your organization’s IT team exclusively uses a specific centralized remote management platform for all legitimate remote execution, with direct PsExec or WMI-based remote execution genuinely never part of their normal workflow—any occurrence of PsExec or ad hoc WMI remote execution outside that platform becomes immediately suspicious by definition, rather than requiring the more nuanced volume-and-pattern analysis needed in environments where IT staff legitimately use these tools directly and routinely.

Combining Signals Across Techniques for Higher Confidence

The strongest lateral movement findings in this category tend to come from correlating multiple of these techniques together rather than relying on any single one—an account performing WMI-based discovery (from the previous piece), followed shortly by PsExec-style remote execution against a newly discovered host, followed by a scheduled task creation on that same host, represents a coherent, escalating pattern that’s considerably more convincing than any single technique observed in isolation.