Dev-0270 WMIC Discovery

Status: available
Severity: high
Time window: 6h
Source: github.com/Azure/Azure-Sentinel

The query below identifies dllhost.exe using WMIC to discover additional hosts and associated domains in the environment.

MITRE ATT&CK coverage

Tactic	Techniques
Discovery	`T1482` Domain Trust Discovery

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4688: A new process has been created.
Microsoft Defender for Endpoint	`DeviceProcessEvents` action `any`: Process activity

Rule body

id: 6b652b4f-9810-4eec-9027-7aa88ce4db23
name: Dev-0270 WMIC  Discovery
description: | 
  'The query below identifies dllhost.exe using WMIC to discover additional hosts and associated domains in the environment.'
severity: High 
requiredDataConnectors:
  - connectorId: SecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: WindowsSecurityEvents
    dataTypes:
      - SecurityEvent
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceProcessEvents
queryFrequency: 6h 
queryPeriod: 6h 
triggerOperator: gt 
triggerThreshold: 0 
status: Available
tactics: 
  - Discovery
relevantTechniques:
  - T1482
tags:
  - Dev-0270
query: |
  (union isfuzzy=true
  (SecurityEvent
  | where EventID==4688
  | where CommandLine has "wmic computersystem get domain" and ParentProcessName has "dllhost.exe"
  | project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type
  ),
  (DeviceProcessEvents 
  | where ProcessCommandLine has "wmic computersystem get domain" and InitiatingProcessFileName =~ "dllhost.exe" and InitiatingProcessCommandLine has "dllhost.exe"
  | extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName
  )
  )
  | extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
  | extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
  | extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])
entityMappings:
  - entityType: Account
    fieldMappings:
      - identifier: FullName
        columnName: Account
      - identifier: Name
        columnName: AccountName
      - identifier: NTDomain
        columnName: AccountNTDomain
  - entityType: Host
    fieldMappings:
      - identifier: FullName
        columnName: Computer
      - identifier: HostName
        columnName: HostName
      - identifier: DnsDomain
        columnName: HostNameDomain
version: 1.0.4
kind: Scheduled

Stages and Predicates

union `isfuzzy=true` (2 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: SecurityEvent, DeviceProcessEvents

Leg 1: `SecurityEvent`

SecurityEvent
| where EventID==4688
| where CommandLine has "wmic computersystem get domain" and ParentProcessName has "dllhost.exe"
| project TimeGenerated, Computer, Account, AccountDomain, ProcessName, ProcessNameFullPath = NewProcessName, EventID, Activity, CommandLine, EventSourceName, Type

Leg 2: `DeviceProcessEvents`

DeviceProcessEvents 
| where ProcessCommandLine has "wmic computersystem get domain" and InitiatingProcessFileName =~ "dllhost.exe" and InitiatingProcessCommandLine has "dllhost.exe"
| extend Account = strcat(InitiatingProcessAccountDomain, @'\', InitiatingProcessAccountName), Computer = DeviceName

Applied to the combined result

| extend HostName = tostring(split(Computer, ".")[0]), DomainIndex = toint(indexof(Computer, '.'))
| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)
| extend AccountName = tostring(split(Account, @'\')[1]), AccountNTDomain = tostring(split(Account, @'\')[0])

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`wmic computersystem get domain` transforms: `term`	`field:"CommandLine" kind:match value:"wmic computersystem get domain"`
`EventID`	eq	`4688` corpus 317 (splunk 283, kusto 33, elastic 1)	`field:"EventID" kind:eq value:"4688"`
`InitiatingProcessCommandLine`	match	`dllhost.exe` transforms: `term` corpus 2 (kusto 2)	`field:"CommandLine" kind:match value:"dllhost.exe"`
`InitiatingProcessFileName`	eq	`dllhost.exe` corpus 9 (elastic 6, kusto 2, splunk 1)	`field:"parent_process_name" kind:eq value:"dllhost.exe"`
`ParentProcessName`	match	`dllhost.exe` transforms: `term`	`field:"ParentImage" kind:match value:"dllhost.exe"`
`ProcessCommandLine`	match	`wmic computersystem get domain` transforms: `term`	`field:"CommandLine" kind:match value:"wmic computersystem get domain"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Account`	`extend`
`AccountDomain`	`project`
`Activity`	`project`
`CommandLine`	`project`
`Computer`	`extend`
`EventID`	`project`
`EventSourceName`	`project`
`ProcessName`	`project`
`ProcessNameFullPath`	`project`
`TimeGenerated`	`project`
`Type`	`project`
`DomainIndex`	`extend`
`HostName`	`extend`
`HostNameDomain`	`extend`
`AccountNTDomain`	`extend`
`AccountName`	`extend`