Remote Service Execution via WMI and PowerShell

Windows Management Instrumentation (MITRE T1047) lets an admin — or an attacker holding admin credentials — execute commands on remote hosts with no agent, no file upload to an admin share, and no new listening service: everything rides over the WMI/DCOM infrastructure that already exists for management. The cleanest code-execution path through it is creating a temporary Windows service via Win32_Service.Create, starting it, then deleting it — a pattern that doubles as MITRE T1543.003 (Create or Modify System Process: Windows Service).

Why WMI for lateral movement

• Built-in and expected: WMI traffic is ordinary admin behavior in most environments, so it blends in where PsExec-style admin-share writes stand out.
• No disk footprint required: the service PathName can be a cmd /c ... or PowerShell one-liner that pulls a payload from memory — the only artifact is the service registration itself.
• Runs as SYSTEM: services created this way execute in the LocalSystem context by default.
• Dual ATT&CK coverage: the transport is T1047 (WMI); the mechanism is T1543.003 (service creation) — detections need to catch either half.

The pattern

# Create the service remotely over an established CIM session
Invoke-CimMethod -CimSession $Session -ClassName Win32_Service -MethodName Create -Arguments @{
    Name        = $ServiceName
    DisplayName = $ServiceName
    PathName    = $Command          # e.g. "cmd /c powershell -enc ..."
    ServiceType = [byte]16          # 16 = Win32OwnProcess
    StartMode   = "Manual"
}
 
# Handle → start → verify stopped → delete (clean up after yourself)
$svc = Get-CimInstance -CimSession $Session -ClassName Win32_Service `
       -Filter "Name LIKE '$ServiceName'"
Invoke-CimMethod -InputObject $svc -MethodName StartService
Invoke-CimMethod -InputObject $svc -MethodName StopService
Invoke-CimMethod -InputObject $svc -MethodName Delete

Notes:

• Invoke-CimMethod uses WS-Man (CIM) sessions rather than legacy DCOM Invoke-WmiMethod; both reach the same Win32_Service provider. See windows-services for why the payload itself usually isn’t a service binary — a normal EXE as PathName dies quickly and logs a failure, which is fine for a one-shot command but wrong for a persistent listener.
• The create/start/delete lifecycle completes in seconds, but every step writes to the event log — ephemeral is not invisible.

Detection

This technique has excellent native telemetry:

• Security EID 4697 / System EID 7045 — service installation events; new services with random names, cmd /c or PowerShell in the binPath, or LocalSystem accounts are near-perfect indicators
• EID 7035/7036 — service start/stop shortly after creation (the ephemeral-service heartbeat)
• WMI activity: WmiPrvSE.exe spawning cmd.exe/powershell.exe on the target, plus Sysmon EID 1 command lines containing Win32_Service / Create
• CISA advisories have documented SVR and PRC state actors using exactly this pattern for lateral movement, so mature SOCs treat wmiprvse → shell process trees as high-severity by default

Sources

• Windows Management Instrumentation — MITRE ATT&CK T1047
• MITRE ATT&CK — T1543.003 Create or Modify System Process: Windows Service
• Create method of the Win32_Service class (CIMWin32 WMI Providers) — Microsoft Learn
• Invoke-CimMethod — Microsoft Learn

Related

• windows-services — what services are, how their config/DACLs live in the registry, and why driver binPaths are a kernel-load primitive
• wmi-powershell-sessions — building the CIM/DCOM session this page’s Invoke-CimMethod calls ride on
• invoke-cimmethod-remote-command — the lighter sibling primitive: Win32_Process.Create for one-shot command execution without a service
• wmic — the deprecated CLI predecessor for the same WMI exec primitive
• wmi-remote-scheduled-task — the scheduled-task variant of this primitive over the same CIM session
• attack-ms-sql-server-powerupsql — the other remote-command-execution channel in a Windows estate (xp_cmdshell over linked servers)
• netstat — confirming the service actually produced the expected listener/connection
• remote-msi-install-powershell — the parallel WMI primitive: Win32_Product.Install for fileless lateral movement via MSI packages