Execution via WMI followed by Network Connection

[rule]
description = """
Identifies the execution of a process via Windows Management Instrumentation (WMI) and where the effective parent is
performing network connections to the internet.
"""
id = "cf738466-9fff-44d9-8603-4a7e6e6c8d1f"
license = "Elastic License v2"
name = "Execution via WMI followed by Network Connection"
os_list = ["windows"]
version = "1.0.8"

query = '''
sequence with maxspan=5m
[process where event.action == "start" and
  process.parent.name : "WmiPrvSE.exe" and process.Ext.effective_parent.executable : "C:\\*" and
  not (process.executable : "?:\\Windows\\System32\\spool\\drivers\\*" and
       process.Ext.effective_parent.executable : "?:\\Windows\\LTSvc\\LTSVC.exe") and
  not (process.name : "WerFault.exe" and process.Ext.effective_parent.name : ("WmiPrvSE.exe", "svchost.exe")) and
  not process.hash.sha256 :
                         ("f4620b3925a5671585e658d009a0909971c75ff24618d95ef366f0b237608ef0",
                          "0e8606ba02828d403e321e37f1568aa321a95d3bdbdb83b73583105b666d79ba") and
  not (process.Ext.effective_parent.executable : "C:\\Windows\\System32\\inetsrv\\w3wp.exe" and
       process.command_line : "C:\\Windows\\system32\\cmd.exe /c C:\\SysMgmt\\service\\mwtools\\SD_Installer_Start.cmd") and
  not (process.code_signature.subject_name : ("FUJITSU CLIENT COMPUTING LIMITED", "Siemens AG") and process.code_signature.trusted == true) and
  not process.Ext.effective_parent.executable : 
                               ("I:\\SCCM\\bin\\X64\\smsexec.exe",
                                "?:\\Program Files\\*.exe",
                                "?:\\Program Files (x86)\\*.exe",
                                "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
                                "?:\\Windows\\CCM\\ClientUX\\SCClient.exe",
                                "C:\\Windows\\CCM\\CcmExec.exe",
                                "C:\\Windows\\ccmcache\\*.exe",
                                "C:\\Windows\\System32\\taskhostw.exe")] by process.Ext.effective_parent.entity_id
[network where 
   /* omitted 192.168.0.0 for testing */
   not cidrmatch(destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24",
       "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32", "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32",
       "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.88.99.0/24", "224.0.0.0/4",
       "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8")] by process.entity_id
'''

min_endpoint_version = "8.4.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.4.0"