Windows Script Interpreter Executing Process via WMI

  1[metadata]
  2creation_date = "2020/11/27"
  3integration = ["endpoint", "windows"]
  4maturity = "production"
  5updated_date = "2024/10/15"
  6min_stack_version = "8.14.0"
  7min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
  8
  9[rule]
 10author = ["Elastic"]
 11description = """
 12Identifies use of the built-in Windows script interpreters (cscript.exe or wscript.exe) being used to execute a process
 13via Windows Management Instrumentation (WMI). This may be indicative of malicious activity.
 14"""
 15from = "now-9m"
 16index = [
 17    "winlogbeat-*",
 18    "logs-endpoint.events.process-*",
 19    "logs-endpoint.events.library-*",
 20    "logs-windows.sysmon_operational-*",
 21    "endgame-*",
 22]
 23language = "eql"
 24license = "Elastic License v2"
 25name = "Windows Script Interpreter Executing Process via WMI"
 26risk_score = 47
 27rule_id = "b64b183e-1a76-422d-9179-7b389513e74d"
 28severity = "medium"
 29tags = [
 30    "Domain: Endpoint",
 31    "OS: Windows",
 32    "Use Case: Threat Detection",
 33    "Tactic: Initial Access",
 34    "Tactic: Execution",
 35    "Data Source: Elastic Endgame",
 36    "Data Source: Elastic Defend",
 37    "Data Source: Sysmon",
 38]
 39type = "eql"
 40
 41query = '''
 42sequence by host.id with maxspan = 5s
 43    [any where host.os.type == "windows" and 
 44     (event.category : ("library", "driver") or (event.category == "process" and event.action : "Image loaded*")) and
 45     (?dll.name : "wmiutils.dll" or file.name : "wmiutils.dll") and process.name : ("wscript.exe", "cscript.exe")]
 46    [process where host.os.type == "windows" and event.type == "start" and
 47     process.parent.name : "wmiprvse.exe" and
 48     user.domain != "NT AUTHORITY" and
 49     (process.pe.original_file_name :
 50        (
 51          "cscript.exe",
 52          "wscript.exe",
 53          "PowerShell.EXE",
 54          "Cmd.Exe",
 55          "MSHTA.EXE",
 56          "RUNDLL32.EXE",
 57          "REGSVR32.EXE",
 58          "MSBuild.exe",
 59          "InstallUtil.exe",
 60          "RegAsm.exe",
 61          "RegSvcs.exe",
 62          "msxsl.exe",
 63          "CONTROL.EXE",
 64          "EXPLORER.EXE",
 65          "Microsoft.Workflow.Compiler.exe",
 66          "msiexec.exe"
 67        ) or
 68      process.executable : ("C:\\Users\\*.exe", "C:\\ProgramData\\*.exe")
 69     )
 70    ]
 71'''
 72
 73
 74[[rule.threat]]
 75framework = "MITRE ATT&CK"
 76[[rule.threat.technique]]
 77id = "T1566"
 78name = "Phishing"
 79reference = "https://attack.mitre.org/techniques/T1566/"
 80[[rule.threat.technique.subtechnique]]
 81id = "T1566.001"
 82name = "Spearphishing Attachment"
 83reference = "https://attack.mitre.org/techniques/T1566/001/"
 84
 85
 86
 87[rule.threat.tactic]
 88id = "TA0001"
 89name = "Initial Access"
 90reference = "https://attack.mitre.org/tactics/TA0001/"
 91[[rule.threat]]
 92framework = "MITRE ATT&CK"
 93[[rule.threat.technique]]
 94id = "T1047"
 95name = "Windows Management Instrumentation"
 96reference = "https://attack.mitre.org/techniques/T1047/"
 97
 98[[rule.threat.technique]]
 99id = "T1059"
100name = "Command and Scripting Interpreter"
101reference = "https://attack.mitre.org/techniques/T1059/"
102[[rule.threat.technique.subtechnique]]
103id = "T1059.005"
104name = "Visual Basic"
105reference = "https://attack.mitre.org/techniques/T1059/005/"
106
107
108
109[rule.threat.tactic]
110id = "TA0002"
111name = "Execution"
112reference = "https://attack.mitre.org/tactics/TA0002/"