Wmiexec Default Output File

calendar Jun 4, 2025 · attack.lateral-movement attack.execution attack.t1047  ·
Share on: linkedin copy

Detects the creation of the default output filename used by the wmiexec tool

Sigma rule (View on GitHub)

 1title: Wmiexec Default Output File
 2id: 8d5aca11-22b3-4f22-b7ba-90e60533e1fb
 3status: test
 4description: Detects the creation of the default output filename used by the wmiexec tool
 5references:
 6    - https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
 7    - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
 8author: Nasreddine Bencherchali (Nextron Systems)
 9date: 2022-06-02
10modified: 2023-03-08
11tags:
12    - attack.lateral-movement
13    - attack.execution
14    - attack.t1047
15logsource:
16    category: file_event
17    product: windows
18detection:
19    selection:
20        - TargetFilename|re: '\\Windows\\__1\d{9}\.\d{1,7}$' # Admin$
21        - TargetFilename|re: 'C:\\__1\d{9}\.\d{1,7}$' # C$
22        - TargetFilename|re: 'D:\\__1\d{9}\.\d{1,7}$' # D$
23    condition: selection
24falsepositives:
25    - Unlikely
26level: critical

References

Related rules

to-top