Potential Remote SquiblyTwo Technique Execution

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation `T1059.005` Command and Scripting Interpreter: Visual Basic `T1059.007` Command and Scripting Interpreter: JavaScript
Stealth	`T1220` XSL Script Processing

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential Remote SquiblyTwo Technique Execution
id: 8d63dadf-b91b-4187-87b6-34a1114577ea
related:
    - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
      type: similar
    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
      type: similar
status: test
description: |
    Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
    to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
    malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
    The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
    with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
    LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
references:
    - https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
    - https://twitter.com/mattifestation/status/986280382042595328 # Deleted
    - https://atomicredteam.io/defense-evasion/T1220/
    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
    - https://x.com/byrne_emmy12099/status/1932346420226658668
author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2019-01-16
modified: 2026-01-24
tags:
    - attack.stealth
    - attack.t1047
    - attack.t1220
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_pe:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
        - Hashes|contains:  # Sysmon field hashes contains all types
              - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
              - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
              - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
              - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
              - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'
    selection_cli:
        CommandLine|contains|windash: '/format:'
        CommandLine|contains:
            - '://'
            - '\\\\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_pe`

selection_pe:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
    - Hashes|contains:
          - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
          - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
          - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
          - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
          - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|windash: '/format:'
    CommandLine|contains:
        - '://'
        - '\\\\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/format:` transforms: `windash` corpus 3 (splunk 2, sigma 1) `://` corpus 3 (sigma 3) `\\\\` corpus 6 (sigma 5, splunk 1)	`field:"CommandLine" kind:match`
`Hashes`	match	`IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00` corpus 2 (sigma 2) `IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E` corpus 2 (sigma 2) `IMPHASH=37777A96245A3C74EB217308F3546F4C` corpus 2 (sigma 2) `IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206` corpus 2 (sigma 2) `IMPHASH=B12619881D79C3ACADF45E752A58554A` corpus 2 (sigma 2)	`field:"Hashes" kind:match`
`Image`	ends_with	`\wmic.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\wmic.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 80 (sigma 38, elastic 24, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`