Library · ATT&CK · T1047

Detecting Windows Management Instrumentation in AWS, Azure, and GCP

01 What is T1047?

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

a13e DCV does not yet ship a13e-curated detection rules for T1047. The page is descriptive: it covers what the technique is, which platforms attackers exercise it on, and where the upstream Sigma community has rules you can translate via CloudSigma. As CloudSigma's corpus extends to this technique, the page lights up with embedded rules automatically — no manual update required.

T1047 sits inside MITRE ATT&CK's enterprise matrix; adversaries reach it via initial access or credential-access steps and pivot from it into impact, lateral movement, or persistence. Cloud blueprints — AWS CloudTrail, Azure Sign-in, GCP Audit Logs — are the high-fidelity observation surfaces where T1047 most reliably surfaces in production. DCV maps each cloud-native finding type to the technique so an a13e coverage scan tells you whether your existing detection controls cover T1047 before an adversary exercises it.

02 Coverage in DCV

DCV does not currently ship a cloud-audit-log finding mapped directly to T1047. The technique earns a library page because a13e research cites it. Detection sits downstream, on the exploitation step the technique enables.

03 Detect with CloudSigma

CloudSigma does not currently ship a stand-alone rule that fires on T1047 in isolation. Generate a starting-point rule from the CVE, vulnerability disclosure, or threat-research blog post that exercises this technique, then pair it with SIEM-side correlation before enabling in production.

High-fidelity detection of T1047 requires correlation across multiple events. For example, a credential-validation call followed by a reconnaissance chain (List* / Describe*) within a short window from an unfamiliar source. A single-event Sigma rule on GetCallerIdentity alone fires constantly on legitimate CLI, SDK and CI/CD activity.

Where you have a specific advisory, vulnerability disclosure or blog post that exercises T1047-style abuse, CloudSigma can generate a starting-point rule from that input. You then deploy it in your SIEM and combine it with the SIEM's native correlation features (timeframe joins across users, source-IP anomalies, impossible-travel checks). For T1047 specifically the generated rule is rarely sufficient on its own; pair it with the SIEM-side correlation logic before enabling in production.

04 Related techniques

05 FAQ

What is T1047?

Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is designed for programmers and is the infrastructure for management data and operations on Windows systems. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model and Windows Remote Management. Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985...

Which cloud platforms does a13e DCV cover for T1047?

a13e DCV does not currently map a cloud-native finding directly to T1047. This page is included for research and coverage-planning context; when platform mappings are added, this answer will list them.

Which SIEMs support T1047 detection via a13e CloudSigma?

a13e CloudSigma does not currently publish a production Sigma rule for T1047. When rules are added, supported SIEM dialects will appear here after SigmaHQ validation and target-SIEM conversion pass.

How many rules does a13e ship for T1047?

No production rules are published for T1047 yet. The count grows when CloudSigma ships new rules tagged to T1047 or when DCV adds a cloud-native finding type that maps to the technique.

How do I instrument T1047 detection in my own environment?

Run a free coverage scan in a13e DCV: it inspects your AWS, Azure, and GCP detection content + maps each existing detection to MITRE ATT&CK. Where T1047 is uncovered, DCV surfaces the gap with an actionable Sigma rule template you can copy into your SIEM. CloudSigma generates a fresh translation per SIEM dialect on demand.

Where can I see live coverage for my environment?

Run a free coverage scan in a13e DCV at https://app.a13e.com. The scan reads your existing detection content (Splunk, Sentinel, Chronicle, Elastic) and reports a per-technique coverage map against MITRE ATT&CK. The output highlights which techniques your DCV instance currently catches and which ones need new rules from CloudSigma.