detection.wiki

Detection rules › Sigma

Potential Remote SquiblyTwo Technique Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1047 Windows Management Instrumentation, T1059.005 Command and Scripting Interpreter: Visual Basic, T1059.007 Command and Scripting Interpreter: JavaScript
StealthT1220 XSL Script Processing

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential Remote SquiblyTwo Technique Execution
id: 8d63dadf-b91b-4187-87b6-34a1114577ea
related:
    - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
      type: similar
    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
      type: similar
status: test
description: |
    Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
    to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
    malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
    The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
    with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
    LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
references:
    - https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
    - https://twitter.com/mattifestation/status/986280382042595328 # Deleted
    - https://atomicredteam.io/defense-evasion/T1220/
    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
    - https://x.com/byrne_emmy12099/status/1932346420226658668
author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2019-01-16
modified: 2026-01-24
tags:
    - attack.stealth
    - attack.t1047
    - attack.t1220
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_pe:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
        - Hashes|contains:  # Sysmon field hashes contains all types
              - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
              - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
              - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
              - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
              - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'
    selection_cli:
        CommandLine|contains|windash: '/format:'
        CommandLine|contains:
            - '://'
            - '\\\\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_pe

selection_pe:
    - Image|endswith: '\wmic.exe'
    - OriginalFileName: 'wmic.exe'
    - Hashes|contains:
          - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
          - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
          - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
          - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
          - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'

Stage 2: selection_cli

selection_cli:
    CommandLine|contains|windash: '/format:'
    CommandLine|contains:
        - '://'
        - '\\\\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /format: transforms: windash corpus 3 (splunk 2, sigma 1)
  • :// corpus 3 (sigma 3)
  • \\\\ corpus 6 (sigma 5, splunk 1)
Hashesmatch
  • IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 corpus 2 (sigma 2)
  • IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E corpus 2 (sigma 2)
  • IMPHASH=37777A96245A3C74EB217308F3546F4C corpus 2 (sigma 2)
  • IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 corpus 2 (sigma 2)
  • IMPHASH=B12619881D79C3ACADF45E752A58554A corpus 2 (sigma 2)
Imageends_with
  • \wmic.exe corpus 60 (sigma 60)
OriginalFileNameeq
  • wmic.exe corpus 61 (sigma 36, splunk 18, elastic 7)