attack.t1047

Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

HackTool - CrackMapExec Execution

Aug 12, 2024 · attack.execution attack.persistence attack.privilege-escalation attack.credential-access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

HackTool - CrackMapExec Execution Patterns

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·

Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

HackTool - Potential Impacket Lateral Movement Activity

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Hardware Model Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·

Share on:

Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

HTML Help HH.EXE Suspicious Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

MITRE BZAR Indicators for Execution

Aug 12, 2024 · attack.execution attack.t1047 attack.t1053.002 attack.t1569.002 ·

Share on:

Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE

New Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·

Share on:

Detects new process creation using WMIC via the "process call create" flag

Potential Maze Ransomware Activity

Aug 12, 2024 · attack.execution attack.t1204.002 attack.t1047 attack.impact attack.t1490 detection.emerging-threats ·

Share on:

Detects specific process characteristics of Maze ransomware word document droppers

Potential Product Class Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 car.2016-03-002 ·

Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Potential Product Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of WMIC in order to get a list of firewall and antivirus products

Potential SquiblyTwo Technique Execution

Aug 12, 2024 · attack.defense-evasion attack.t1047 attack.t1220 attack.execution attack.t1059.005 attack.t1059.007 ·

Share on:

Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields

Potential Unquoted Service Path Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·

Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Process Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of "wmic" with the "process" flag, which adversary might use to list processes running on the compromised host or list installed software hotfixes and patches.

PSExec and WMI Process Creations Block

Aug 12, 2024 · attack.execution attack.lateral-movement attack.t1047 attack.t1569.002 ·

Share on:

Detects blocking of process creations originating from PSExec and WMI commands

Remote DCOM/WMI Lateral Movement

Aug 12, 2024 · attack.lateral-movement attack.t1021.003 attack.t1047 ·

Share on:

Detects remote RPC calls that performs remote DCOM operations. These could be abused for lateral movement via DCOM or WMI.

Script Event Consumer Spawning Process

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Service Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable

Service Started/Stopped Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects usage of wmic to start or stop a service

Successful Account Login Via WMI

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects successful logon attempts performed with WMI

Suspicious Encoded Scripts in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1047 attack.persistence attack.t1546.003 ·

Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Suspicious HH.EXE Execution

Aug 12, 2024 · attack.defense-evasion attack.execution attack.initial-access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Suspicious Microsoft Office Child Process

Aug 12, 2024 · attack.defense-evasion attack.execution attack.t1047 attack.t1204.002 attack.t1218.010 ·

Share on:

Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Suspicious Process Created Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Suspicious WMIC Execution Via Office Process

Aug 12, 2024 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense-evasion ·

Share on:

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Suspicious WmiPrvSE Child Process

Aug 12, 2024 · attack.execution attack.defense-evasion attack.t1047 attack.t1204.002 attack.t1218.010 ·

Share on:

Detects suspicious and uncommon child processes of WmiPrvSE

System Disk And Volume Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.discovery attack.t1047 attack.t1082 ·

Share on:

An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the wmic command-line utility and has been observed being used by threat actors such as Volt Typhoon.

T1047 Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network for a WMI DLL Hijack scenario.

UNC2452 PowerShell Pattern

Aug 12, 2024 · attack.execution attack.t1059.001 attack.t1047 detection.emerging-threats ·

Share on:

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Windows Hotfix Updates Reconnaissance Via Wmic.EXE

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

WMI Event Consumer Created Named Pipe

Aug 12, 2024 · attack.t1047 attack.execution ·

Share on:

Detects the WMI Event Consumer service scrcons.exe creating a named pipe

WMIC Remote Command Execution

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects the execution of WMIC to query information on a remote system

WMIC Unquoted Services Path Lookup - PowerShell

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

Wmiexec Default Output File

Aug 12, 2024 · attack.lateral-movement attack.t1047 ·

Share on:

Detects the creation of the default output filename used by the wmiexec tool

WMImplant Hack Tool

Aug 12, 2024 · attack.execution attack.t1047 attack.t1059.001 ·

Share on:

Detects parameters used by WMImplant

WmiPrvSE Spawned A Process

Aug 12, 2024 · attack.execution attack.t1047 ·

Share on:

Detects WmiPrvSE spawning a process

Wmiprvse Wbemcomn DLL Hijack

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Wmiprvse Wbemcomn DLL Hijack - File

Aug 12, 2024 · attack.execution attack.t1047 attack.lateral-movement attack.t1021.002 ·

Share on:

Detects a threat actor creating a file named wbemcomn.dll in the C:\Windows\System32\wbem\ directory over the network and loading it for a WMI DLL Hijack scenario.

Office Products Spawning WMI

Mar 26, 2024 · attack.execution attack.t1047 attack.t1204 ·

Share on:

It’s almost always malicious when wmic.exe spawns as a child process of Microsoft Office and similar products. As such, it makes sense to examine the chain of execution and follow-on activity when this occurs. The following is a non-exhaustive example analytic that will catch some of this activity. Part of the RedCanary 2024 Threat Detection Report.

Suspicious Commands - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·

Share on:

Looking for suspicious command-line parameters is another solid indicator of malice. Certain red team and post-exploitation frameworks will spawn unique and unsigned binaries or commands remotely using the well known process call create command, and we’ve got a couple different detection methods that have alerted us to related activity over the years. Potentially suspicious WMI command switches include create, node:, process, and call. Of course, the maliciousness of these commands are context-specific, and therefore, the following may require tuning or generate high volumes of false positives. Part of the RedCanary 2024 Threat Detection Report.

Suspicious PowerShell Cmdlets - WMI

Mar 26, 2024 · attack.execution attack.t1047 attack.t1059 attack.t1059.001 ·

Share on:

There are numerous default PowerShell cmdlets that allow administrators to leverage WMI via PowerShell. Both adversaries and administrators use these cmdlets to query the operating system or execute commands, either locally or remotely. Cmdlets like Get-WMIObject are often used for reconnaissance. Part of the RedCanary 2024 Threat Detection Report.

Suspicious Process Lineage - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·

Share on:

In general, trusted binaries and known administrative tools and processes will initiate WMI activity. As such, it makes sense to look for known bad processes launching WMI or deviations from the expected where a legitimate but unusual Windows binary spawns WMI—or spawns from it. The following is an amalgamation of several analytics that can detect a wide array of threats, ranging from red team activity to web shells to coinminers. Part of the RedCanary 2024 Threat Detection Report.

Unusual Module Loads - WMI

Mar 26, 2024 · attack.execution attack.t1047 ·

Share on:

By monitoring and detecting on module loads, you can catch a variety of different malicious activities, including defense evasion and credential theft. In cases where an adversary is using WMI for credential theft, consider looking for the execution of wmiprvse.exe (or its child processes) with unusual module loads like samlib.dll or vaultcli.dll. WMI is also a useful vehicle for bypassing application controls, and we commonly see adversaries—real and simulated–using a WMI bypass method called “SquibblyTwo.” The following pseudo-detection analytic is designed specifically to catch application control bypasses, but you can likely adapt it to detect other threats by substituting in a different DLL or by removing the command. Part of the RedCanary 2024 Threat Detection Report.

WMI Reconnaissance

Mar 26, 2024 · attack.execution attack.t1047 attack.discovery attack.t1087 attack.t1087.002 ·

Share on:

Reconnaissance is harder to detect because it looks very similar to normal admin behavior. Even so, we detect a relatively high volume of adversaries leveraging WMI to quickly gather domain information such as users, groups, or computers in the domain. The following may help you detect related activity. Part of the RedCanary 2024 Threat Detection Report.

WMI Shadow Copy Deletion

Mar 26, 2024 · attack.execution attack.t1047 attack.impact attack.t1490 ·

Share on:

It’s not uncommon for ransomware operators to leverage WMI to delete volume shadows, significantly complicating the process for recovering access to encrypted systems and files. If you want to detect ransomware using WMI to delete shadow copies, consider looking for wmic.exe execution with command lines including shadowcopy or delete. Part of the RedCanary 2024 Threat Detection Report.

Wmiexec.py Execution

Mar 26, 2024 · attack.s0357 attack.execution attack.t1047 attack.lateral_movement attack.t1021 attack.t1021.003 ·

Share on:

This detection analytic looks for wmiprvse.exe spawn cmd.exe with the following command line, cmd.exe /Q /c ', ' 1 \\', ' 2 &1. These strings are specific to the execution of wmiexe.py, which allows a semi-interactive shell used via WMI. Part of the RedCanary 2024 Threat Detection Report.

Office Products Spawning WMI (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects MS Office applications spawning WMI processes. Part of the RedCanary 2023 Threat Detection Report.

WMI Reconnaissance (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the wmic reconnaissance activity. Part of the RedCanary 2023 Threat Detection Report.

WMI Shadow Copy Deletion (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects wmic shadow copy deletion activity. Part of the RedCanary 2023 Threat Detection Report.

WMI Suspicious Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the wmic process with suspicious options. Part of the RedCanary 2023 Threat Detection Report.

WMI Suspicious Powershell Cmdlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects WMI-related suspicious powershell cmdlets. Part of the RedCanary 2023 Threat Detection Report.

WMI Suspicious Process Lineage (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the WMI provider host spawning suspicious processes. Part of the RedCanary 2023 Threat Detection Report.

WMIC Unusual Module Loads (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1047 ·

Share on:

Detects the wmic process module loads potentially to perform application control bypasses. Part of the RedCanary 2023 Threat Detection Report.

File Creation by Office Applications

Apr 21, 2023 · attack.t1204.002 attack.t1047 attack.t1218.010 attack.execution attack.defense_evasion ·

Share on:

This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.

Suspicious WMI-Related Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 attack.t1047 ·

Share on:

Detects potential adversaries using powershell WMI-related cmdlets to query the operating system or execute commands, either locally or remotely. Inspired by the 2022 Red Canary Threat Detection report.

WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·

Share on:

Detects adversaries leveraging WMI to gather domain information such as users, groups, AV product in use, or computers in the domain. Inspired by the 2022 Red Canary Threat Detection report.

WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·

Share on:

Detects suspicious parent-child relationships with the wmiprvse command. Inspired by the 2022 Red Canary Threat Detection report.

WMIC Suspicious Commands

Nov 9, 2022 · attack.execution attack.t1047 ·

Share on:

Detects spawning of unique and unsigned binaries or commands remotely using the well known process call create command. Inspired by the 2022 Red Canary Threat Detection report.