Suspicious Cmd Execution via WMI

[rule]
description = """
Identifies suspicious command execution (cmd) via Windows Management Instrumentation (WMI) on a remote host. This could
be indicative of adversary lateral movement.
"""
id = "242ccb88-5e28-4a74-ac6a-ff0e4c814ad8"
license = "Elastic License v2"
name = "Suspicious Cmd Execution via WMI"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/elastic-protects-against-data-wiper-malware-targeting-ukraine-hermeticwiper",
    "https://www.elastic.co/security-labs/operation-bleeding-bear",
    "https://www.elastic.co/security-labs/unmasking-financial-services-intrusion-ref0657",
]
version = "1.0.35"

query = '''
process where event.action == "start" and
(
 (process.name : "cmd.exe" and process.args : "/c" and process.args:"/Q" and process.parent.name : "WmiPrvSE.exe" and
  process.args : "2>&1" and process.args: "1>" and
  process.args : ("C:\\windows\\temp\\*.txt",
                  "\\Windows\\Temp\\*",
                  "-encodehex",
                  "\\\\127.0.0.1\\C$\\Windows\\Temp\\*") and
  not process.command_line : ("*servicenow\\psscript_output*", "*Impact360\\Software*")) or

 descendant of [process where event.action == "start" and process.name : "cmd.exe" and process.args : "/c" and process.args:"/Q" and
                process.parent.name : "WmiPrvSE.exe" and
                process.args : "2>&1" and process.args: "1>" and
                process.args : ("C:\\windows\\temp\\*.txt",
                                "\\Windows\\Temp\\*",
                                "-encodehex",
                                "\\\\127.0.0.1\\C$\\Windows\\Temp\\*") and
                not process.command_line : ("*servicenow\\psscript_output*", "*Impact360\\Software*")]
 ) and
 not process.executable : ("?:\\Windows\\system32\\conhost.exe", "?:\\Windows\\System32\\findstr.exe", "?:\\Windows\\System32\\chcp.com") and
 not (process.parent.name : "cmd.exe" and process.parent.command_line : "*\\127.0.0.1\\c$\\temp\\cotportal\\COT_Mid_Cluster*") and
 not process.executable : "?:\\Program Files\\MySQL\\MySQL Server *\\bin\\mysqld.exe" and
 not (process.name : ("mysqld.exe", "mysql.exe") and process.parent.args : "\\\\127.0.0.1\\c$\\temp\\*\\psscript_output_*.txt") and
 not process.command_line : ("sc  query RemoteRegistry ", "sc  start RemoteRegistry ") and
 not (process.code_signature.subject_name == "MariaDB Corporation Ab" and process.code_signature.trusted == true) and
 not (process.name : ("powershell.exe", "cmd.exe") and
      process.command_line : ("powershell  -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQ*",
                              "C:\\Windows\\system32\\cmd.exe /C powershell -EncodedCommand JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQA9ACIAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQ*"))
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"

[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"