Enumeration Command Spawned via WMIPrvSE

  1[metadata]
  2creation_date = "2021/01/19"
  3integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel"]
  4maturity = "production"
  5updated_date = "2024/10/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies native Windows host and network enumeration commands spawned by the Windows Management Instrumentation
 13Provider Service (WMIPrvSE).
 14"""
 15from = "now-9m"
 16index = [
 17    "winlogbeat-*",
 18    "logs-endpoint.events.process-*",
 19    "logs-windows.forwarded*",
 20    "logs-windows.sysmon_operational-*",
 21    "endgame-*",
 22    "logs-system.security*",
 23    "logs-m365_defender.event-*",
 24    "logs-sentinel_one_cloud_funnel.*",
 25]
 26language = "eql"
 27license = "Elastic License v2"
 28name = "Enumeration Command Spawned via WMIPrvSE"
 29risk_score = 21
 30rule_id = "770e0c4d-b998-41e5-a62e-c7901fd7f470"
 31severity = "low"
 32tags = [
 33    "Domain: Endpoint",
 34    "OS: Windows",
 35    "Use Case: Threat Detection",
 36    "Tactic: Execution",
 37    "Data Source: Elastic Endgame",
 38    "Data Source: Elastic Defend",
 39    "Data Source: System",
 40    "Data Source: Microsoft Defender for Endpoint",
 41    "Data Source: Sysmon",
 42    "Data Source: SentinelOne",
 43]
 44timestamp_override = "event.ingested"
 45type = "eql"
 46
 47query = '''
 48process where host.os.type == "windows" and event.type == "start" and process.command_line != null and 
 49  process.name:
 50  (
 51    "arp.exe", "dsquery.exe", "dsget.exe", "gpresult.exe", "hostname.exe", "ipconfig.exe", "nbtstat.exe",
 52    "net.exe", "net1.exe", "netsh.exe", "netstat.exe", "nltest.exe", "ping.exe", "qprocess.exe", "quser.exe",
 53    "qwinsta.exe", "reg.exe", "sc.exe", "systeminfo.exe", "tasklist.exe", "tracert.exe", "whoami.exe"
 54  ) and
 55  process.parent.name:"wmiprvse.exe" and 
 56  not (
 57    process.name : "sc.exe" and process.args : "RemoteRegistry" and process.args : "start=" and 
 58    process.args : ("demand", "disabled")
 59  ) and
 60  not process.args : "tenable_mw_scan"
 61'''
 62
 63
 64[[rule.threat]]
 65framework = "MITRE ATT&CK"
 66[[rule.threat.technique]]
 67id = "T1047"
 68name = "Windows Management Instrumentation"
 69reference = "https://attack.mitre.org/techniques/T1047/"
 70
 71
 72[rule.threat.tactic]
 73id = "TA0002"
 74name = "Execution"
 75reference = "https://attack.mitre.org/tactics/TA0002/"
 76[[rule.threat]]
 77framework = "MITRE ATT&CK"
 78[[rule.threat.technique]]
 79id = "T1016"
 80name = "System Network Configuration Discovery"
 81reference = "https://attack.mitre.org/techniques/T1016/"
 82[[rule.threat.technique.subtechnique]]
 83id = "T1016.001"
 84name = "Internet Connection Discovery"
 85reference = "https://attack.mitre.org/techniques/T1016/001/"
 86
 87
 88[[rule.threat.technique]]
 89id = "T1018"
 90name = "Remote System Discovery"
 91reference = "https://attack.mitre.org/techniques/T1018/"
 92
 93[[rule.threat.technique]]
 94id = "T1057"
 95name = "Process Discovery"
 96reference = "https://attack.mitre.org/techniques/T1057/"
 97
 98[[rule.threat.technique]]
 99id = "T1087"
100name = "Account Discovery"
101reference = "https://attack.mitre.org/techniques/T1087/"
102
103[[rule.threat.technique]]
104id = "T1518"
105name = "Software Discovery"
106reference = "https://attack.mitre.org/techniques/T1518/"
107
108
109[rule.threat.tactic]
110id = "TA0007"
111name = "Discovery"
112reference = "https://attack.mitre.org/tactics/TA0007/"