WMI Module Loaded By Uncommon Process

{
  "image_load": {
    "EventID": 7,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "ImageLoaded
| endswith": [
      "\\fastprox.dll",
      "\\wbemcomn.dll",
      "\\wbemprox.dll",
      "\\wbemsvc.dll",
      "\\WmiApRpl.dll",
      "\\wmiclnt.dll",
      "\\WMINet_Utils.dll",
      "\\wmiprov.dll",
      "\\wmiutils.dll"
    ]
  },
  "filter_main_generic": {
    "Image
| contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\explorer.exe",
      ":\\Windows\\Microsoft.NET\\Framework\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm64\\",
      ":\\Windows\\Microsoft.NET\\Framework64\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_other": {
    "Image
| endswith": [
      "\\WindowsAzureGuestAgent.exe",
      "\\WaAppAgent.exe"
    ]
  },
  "filter_optional_thor": {
    "Image
| endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ]
  },
  "filter_optional_defender": {
    "Image
| endswith": "\\MsMpEng.exe"
  },
  "filter_optional_teams": {
    "Image
| contains": [
      "\\Microsoft\\Teams\\current\\Teams.exe",
      "\\Microsoft\\Teams\\Update.exe"
    ]
  },
  "filter_optional_sysmon": {
    "Image
| endswith": [
      ":\\Windows\\Sysmon.exe",
      ":\\Windows\\Sysmon64.exe",
      ":\\Windows\\Sysmon64a.exe"
    ]
  },
  "condition": "image_load and (selection and not 1 of filter_main_* and not 1 of filter_optional_*)"
}

False Positives

• ⚠ Unknown