WMIC Loading Scripting Libraries

Status: test
Severity: medium
Log source: category image_load, product windows
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.

Known false positives

The command wmic os get lastbootuptime loads vbscript.dll
The command wmic os get locale loads vbscript.dll
Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
The command `wmic ntevent` loads vbscript.dll

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1220` XSL Script Processing

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: WMIC Loading Scripting Libraries
id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
related:
    - id: 8d63dadf-b91b-4187-87b6-34a1114577ea
      type: similar
    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
      type: similar
status: test
description: |
    Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
    It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.
references:
    - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
    - https://twitter.com/dez_/status/986614411711442944
    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-10-17
modified: 2022-10-13
tags:
    - attack.stealth
    - attack.t1220
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        ImageLoaded|endswith:
            - '\jscript.dll'
            - '\vbscript.dll'
    condition: selection
falsepositives:
    - The command wmic os get lastbootuptime loads vbscript.dll
    - The command wmic os get locale loads vbscript.dll
    - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
    - The command `wmic ntevent` loads vbscript.dll
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\wmic.exe'
    ImageLoaded|endswith:
        - '\jscript.dll'
        - '\vbscript.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\wmic.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\wmic.exe"`
`ImageLoaded`	ends_with	`\jscript.dll` corpus 2 (sigma 2) `\vbscript.dll` corpus 3 (sigma 3)	`field:"ImageLoaded" kind:ends_with`