detection.wiki

Detection rules › Sigma

Local Groups Reconnaissance Via Wmic.EXE

Status
test
Severity
low
Log source
product windows, category process_creation
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects the execution of "wmic" with the "group" flag. Adversaries may attempt to find local system groups and permission settings. The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1069.001 Permission Groups Discovery: Local Groups

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Local Groups Reconnaissance Via Wmic.EXE
id: 164eda96-11b2-430b-85ff-6a265c15bf32
status: test
description: |
    Detects the execution of "wmic" with the "group" flag.
    Adversaries may attempt to find local system groups and permission settings.
    The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
    Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
author: frack113
date: 2021-12-12
modified: 2023-02-14
tags:
    - attack.discovery
    - attack.t1069.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains: ' group'
    condition: all of selection*
falsepositives:
    - Unknown
level: low

Stages and Predicates

Stage 0: condition

all of selection*

Stage 1: selection_img

selection_img:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains: ' group'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • group corpus 2 (sigma 2)
Imageends_with
  • \wmic.exe corpus 60 (sigma 60)
OriginalFileNameeq
  • wmic.exe corpus 61 (sigma 36, splunk 18, elastic 7)