Suspicious Execution via Windows Management Instrumentation

[rule]
description = "Identifies suspicious processes executing via the Windows Management Instrumentation (WMI) protocol."
id = "7e554c18-6435-41ce-b57b-d0ac3b73817f"
license = "Elastic License v2"
name = "Suspicious Execution via Windows Management Instrumentation"
os_list = ["windows"]
version = "1.0.50"

query = '''
process where event.action == "start" and
 process.parent.name : "WmiPrvSe.exe" and not user.id : "S-1-5-18" and
 (
  (process.name : ("rundll32.exe", "regsvr32.exe", "mshta.exe", "wmic.exe", "wscript.exe", "bitsadmin.exe", "certutil.exe", "vssadmin.exe", "curl.exe")) or
  (process.name : "schtasks.exe" and process.args : "/create") or
  (process.name : "cmd.exe" and process.command_line : ("*powershell*", "*mshta*", "*wmic*", "*msiexec*", "*\\AppData\\Local\\Temp\\*.bat")) or
  process.executable : ("?:\\Users\\*\\AppData\\*.exe", "?:\\Users\\Public\\*", "?:\\ProgramData\\*.exe", "?:\\Windows\\Tasks\\*.exe") or
  (process.name : ("powershell.exe", "cmd.exe") and
      process.command_line :
        (
          "*^*^*^*^*^*^*^*^*^*",
          "*set *set *set *",
          "*set *for *call *",
          "*set *for *cmd *",
          "*$*$*$*$*$*$*$*$*$*$*$*",
          "*comspec*",
          "*%%*%%*%%*",
          "*''*''*''*",
          "*`*`*`*`*",
          "*+*+*+*+*+*",
          "*[char[]](*)*-join",
          "*Base64String*",
          "*[*Convert]*",
          "*.Text.Encoding*",
          "*.Compression.*",
          "*.replace*",
          "*MemoryStream*",
          "*WriteAllBytes*",
          "* -en* *",
          "* -ec *",
          "* -e *",
          "* /e *",
          "* /en* *",
          "* /ec *",
          "*WebClient*",
          "*DownloadFile*",
          "*DownloadString*",
          "*Invoke-Exp*",
          "*invoke-web*",
          "*iex*",
          "*iwr*",
          "*Reflection.Assembly*",
          "*Assembly.GetType*"
        )) or
	(process.name : "powershell.exe" and length(process.command_line) > 200 )
) and

/* Noisy FPs */

not (process.name : ("powershell.exe", "cmd.exe") and
     process.command_line : ("*Windows\\CCM\\*", "*WINDOWS\\TEMP\\nessus_*", "*%SystemRoot%\\TEMP\\nessus_*",
     "*\\admin$\\temp\\cotportal_EAS_SP-SNOW*", "*/latest/dynamic/instance-identity/*", "*Get-NetFirewallProfile*",
     "*windows\\temp\\netstatcache_*", "*$ErrorActionPreference*", "*D:\\SMS_DP$\\Ms.Dsp.Do.Inc.Setup\\Install.ps1*",
     "*app360edatabase\\Install-360DB.ps1*", "*CgAgACAAIAAgAHQAcgBhAHAAIA*", "*Cert:LocalMachine -Recurse*",
     "*\\Program Files\\*", "*\\Program Files (x86)\\*", "*CloudamizeAgentless*", "*Get-AppxP*", 
     "*Windows\\System32\\AppvClient\\AppvClient.psd1*", "*###break###'} Catch {}*", "*FQARQBNAFAAXABuAGUAcwBzAHUAcwBfA*",
     "*AFMAUgBFAEcAXwBVAE4ASwBOAE8AVwBOAF8ASgBPAEkATg*", "*bgBlAHMAcwB1AHMAXwBhAHoAdQByAGUAXwBhA*",
     "*EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQA*", "*\\admeScript.ps1\\*", "*\\\\127.0.0.1\\ADMIN$\\apckscanner-*",
     "*QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7A*",
     "*\\\\127.0.0.1\\admin$\\temp\\unregistered*", "*System.Security.Principal.NTAccount*\\ADMIN$\\d42*",
     "*metadata/instance?api-version*", "*C:\\WINDOWS\\Temp\\csat\\*", "*google.internal/computeMetadata/v1/instance/*",
     "*/opc/v2/instance*", "*254/opc/v1/instance*", "Powershell.exe Invoke-Expression 'Enable-PSRemoting -Force'",
     "*C:\\WINDOWS\\TEMP\\Positive Technologies\\PT-file*", "*LastLogin, BadPasswordAttempts, PasswordAge, Username*")) and

not (process.name : "cmd.exe" and process.command_line : ("*echo*Spiceworks\\spiceworks_upload.vbs*", "*\\psscript_output_*", "*SNC_isWmi*")) and

not (process.name : "cmd.exe" and process.command_line : "*\\127.0.0.1\\ADMIN$\\axonius\\*") and

not (process.name : "powershell.exe" and process.command_line : ("*CodexHealthPoll*", "*CRAMITClientActivity*", "*Get-MECM*")) and

not (process.pe.original_file_name in ("ATMGR.EXE", "git.exe") and process.code_signature.trusted == true) and

not (process.name : ("cscript.exe", "wscript.exe") and
     process.args : ("?:\\windows\\CCM\\*", "?:\\windows\\ccmcache\\*") and process.args_count <= 3) and

not (process.pe.original_file_name in ("PinVantageToolbarToast.exe", "Update.exe", "git-credential-manager-core.exe", "DismHost.exe") and
     process.code_signature.trusted == true) and

not (process.name : "cmd.exe" and process.working_directory : "?:\\tmp\\smartcheck\\sitetool\\proc\\*" and
     process.command_line : "*Citrix.SmartChecks.BlueprintBootstrap*-xdSiteId*") and

not (process.pe.original_file_name == "360se.exe" and process.code_signature.trusted == true and
     process.code_signature.subject_name == "Beijing Qihu Technology Co., Ltd.") and

not (process.code_signature.trusted == true and 
     process.code_signature.subject_name : 
                    ("Synology Inc.", "Zoom Video Communications, Inc.", "Beijing Qihu Technology Co., Ltd.", "Chocolatey Software, Inc.",
		     "Autodesk, Inc.", "Thomson Reuters Corporation", "Hornetsecurity GmbH")) and

not (process.name : "regsvr32.exe" and process.args : ("?:\\SMS_DP$\\*\\smsdp.dll", "\\\\*\\smsdp.dll") and process.args : "/s") and

not (process.name : "cmd.exe" and
     process.args : ("\\\\127.0.0.1\\ADMIN$\\__*", "DB.name >> %userprofile%\\discoRemote.cmd", "echo SET _cmd=sqlcmd -E -Q SELECT")) and

not process.hash.sha256 :
                ("0e692d9d3342fdcab1ce3d61aed0520989a94371e5898edb266c92f1fe11c97f",
                 "4402920c711aba26297de5ea39fcb58448ade9df77e978f1d8cd326fd810c62d",
                 "0d9c6de8a57443bffe718d3256fdd467b8970124ba65d8accb6f47dc54d46d72",
                 "fc18fbb2b4e54c25ea3fdcdd9682735a636dd61127da451a2c19fd7e8d154285",
                 "0d6f7b29a06cb188ce67bd99ec0a3d1fa7dda2d64a69b3279ec90e04d35c8bfb",
                 "24863db91f7f1222c8310160e78f2c6c8a0ed9b4c18640029e65e3a3a3c1944d",
                 "2733a27117ec81c7f867c4b1a6a800011fa432e45b7e95656c37ee05ca68c592",
                 "8e597fdafc174a30633cc470b763f6ba65e79aada99adc394df745913fe41111",
                 "34c5c838199700dd344b8d606163ce4f05db72397c9aaf129f52b70b38c1d187") and

not process.executable : "?:\\ProgramData\\Microsoft Azure Site Recovery\\Mobility Service\\WMISSH\\*.exe" and 

not (process.name : "regsvr32.exe" and process.command_line : "regsvr32.exe ?:\\SMS_DP$\\sms\\bin\\smsdp.dll /s") and 
not process.executable : "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCmdRun.exe" and 
not (process.name : "rundll32.exe" and 
     process.command_line : "\"?:\\WINDOWS\\system32\\rundll32.exe\" C:\\WINDOWS\\system32\\eed_ec.dll,SpeedLauncher") and
not (process.name : "schtasks.exe" and process.args : ("cmd /c echo N | gpupdate /force", "shutdown /r /f /t *")) and
not (process.name : "powershell.exe" and
     process.args : ("\\\\*.ps1", "\\\\127.0.0.1\\admin$\\temp\\unregistered", "?:\\SMS_DP$\\*",
                     "QQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuA*",
                     "cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnA*"))
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.15.0"