WMI-Activity Event ID 5857 — WMI provider started an operation

A WMI provider was loaded and started an operation, recording the provider, the client process ID and the user context. The core telemetry for observing WMI usage.

Why event 5857 matters

Baseline WMI activity is noisy, but 5857 exposes abuse: WmiPrvSE.exe spawning cmd/powershell, remote WMI execution (Impacket wmiexec, wmic /node), and reconnaissance queries. It is the anchor event for hunting WMI-based lateral movement and living-off-the-land execution.

How to detect it

Hunt WmiPrvSE.exe child processes via 4688/Sysmon 1. Flag remote WMI operations from unusual source hosts and off-hours. Use with 5860/5861 to catch subscription-based persistence.

MITRE ATT&CK mapping

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

title: Suspicious WMI Provider Operation
status: experimental
logsource:
  product: windows
  service: wmi
detection:
  sel:
    EventID: 5857
  condition: sel
level: low

Event
| where EventLog == "Microsoft-Windows-WMI-Activity/Operational" and EventID == 5857   // WMI provider started an operation
// EventData holds: Operation, ClientProcessId, User, NamespaceName
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

index=* sourcetype="WinEventLog:Microsoft-Windows-WMI-Activity/Operational" EventCode=5857
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# WMI provider started an operation — add EventData fields: Operation, ClientProcessId, User, NamespaceName`

References

• learn.microsoft.com
• attack.mitre.org