Suspicious WMIC XSL Script Execution
Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting libraries it may be indicative of an allowlist bypass.
Elastic rule (View on GitHub)
1[metadata]
2creation_date = "2020/09/02"
3integration = ["endpoint", "windows"]
4maturity = "production"
5min_stack_comments = "New fields added: required_fields, related_integrations, setup"
6min_stack_version = "8.3.0"
7updated_date = "2024/04/08"
8
9[rule]
10author = ["Elastic"]
11description = """
12Identifies WMIC allowlist bypass techniques by alerting on suspicious execution of scripts. When WMIC loads scripting
13libraries it may be indicative of an allowlist bypass.
14"""
15from = "now-9m"
16index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-endpoint.events.library-*", "logs-windows.sysmon_operational-*"]
17language = "eql"
18license = "Elastic License v2"
19name = "Suspicious WMIC XSL Script Execution"
20risk_score = 47
21rule_id = "7f370d54-c0eb-4270-ac5a-9a6020585dc6"
22severity = "medium"
23tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Defense Evasion", "Tactic: Execution", "Data Source: Elastic Defend", "Data Source: Sysmon"]
24type = "eql"
25
26query = '''
27sequence by process.entity_id with maxspan = 2m
28[process where host.os.type == "windows" and event.type == "start" and
29 (process.name : "WMIC.exe" or process.pe.original_file_name : "wmic.exe") and
30 process.args : ("format*:*", "/format*:*", "*-format*:*") and
31 not process.command_line : ("* /format:table *", "* /format:table")]
32[any where host.os.type == "windows" and (event.category == "library" or (event.category == "process" and event.action : "Image loaded*")) and
33 (?dll.name : ("jscript.dll", "vbscript.dll") or file.name : ("jscript.dll", "vbscript.dll"))]
34'''
35
36
37[[rule.threat]]
38framework = "MITRE ATT&CK"
39[[rule.threat.technique]]
40id = "T1220"
41name = "XSL Script Processing"
42reference = "https://attack.mitre.org/techniques/T1220/"
43
44
45[rule.threat.tactic]
46id = "TA0005"
47name = "Defense Evasion"
48reference = "https://attack.mitre.org/tactics/TA0005/"
49
50[[rule.threat]]
51framework = "MITRE ATT&CK"
52
53[[rule.threat.technique]]
54id = "T1047"
55name = "Windows Management Instrumentation"
56reference = "https://attack.mitre.org/techniques/T1047/"
57
58[rule.threat.tactic]
59id = "TA0002"
60name = "Execution"
61reference = "https://attack.mitre.org/tactics/TA0002/"
Related rules
- Network Connection via Registration Utility
- Command Shell Activity Started via RunDLL32
- Conhost Spawned By Suspicious Parent Process
- Microsoft Build Engine Using an Alternate Name
- Persistence via Hidden Run Key Detected