Suspicious WMIC Execution Via Office Process

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Vadim Khrykov, Cyb3rEng
Source: github.com/SigmaHQ/sigma

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation `T1204.002` User Execution: Malicious File
Stealth	`T1218.010` System Binary Proxy Execution: Regsvr32

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious WMIC Execution Via Office Process
id: e1693bc8-7168-4eab-8718-cdcaa68a1738
related:
    - id: 438025f9-5856-4663-83f7-52f878a70a50
      type: derived
    - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a
      type: obsolete
    - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0
      type: obsolete
    - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5
      type: obsolete
    - id: 04f5363a-6bca-42ff-be70-0d28bf629ead
      type: obsolete
status: test
description: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).
references:
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
    - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
author: Vadim Khrykov, Cyb3rEng
date: 2021-08-23
modified: 2023-02-14
tags:
    - attack.stealth
    - attack.t1204.002
    - attack.t1047
    - attack.t1218.010
    - attack.execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\WINWORD.EXE'
            - '\EXCEL.EXE'
            - '\POWERPNT.exe'
            - '\MSPUB.exe'
            - '\VISIO.exe'
            - '\MSACCESS.EXE'
            - '\EQNEDT32.EXE'
            - '\ONENOTE.EXE'
            - '\wordpad.exe'
            - '\wordview.exe'
    selection_wmic_img:
        - Image|endswith: '\wbem\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_wmic_cli:
        CommandLine|contains|all:
            - 'process'
            - 'create'
            - 'call'
        CommandLine|contains:
            # Add more suspicious LOLBINs as you see fit
            - 'regsvr32'
            - 'rundll32'
            - 'msiexec'
            - 'mshta'
            - 'verclsid'
            - 'wscript'
            - 'cscript'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith:
        - '\WINWORD.EXE'
        - '\EXCEL.EXE'
        - '\POWERPNT.exe'
        - '\MSPUB.exe'
        - '\VISIO.exe'
        - '\MSACCESS.EXE'
        - '\EQNEDT32.EXE'
        - '\ONENOTE.EXE'
        - '\wordpad.exe'
        - '\wordview.exe'

Stage 2: `selection_wmic_img`

selection_wmic_img:
    - Image|endswith: '\wbem\WMIC.exe'
    - OriginalFileName: 'wmic.exe'

Stage 3: `selection_wmic_cli`

selection_wmic_cli:
    CommandLine|contains|all:
        - 'process'
        - 'create'
        - 'call'
    CommandLine|contains:
        - 'regsvr32'
        - 'rundll32'
        - 'msiexec'
        - 'mshta'
        - 'verclsid'
        - 'wscript'
        - 'cscript'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`call` corpus 8 (sigma 6, splunk 2) `create` corpus 29 (sigma 17, splunk 7, elastic 5) `cscript` corpus 15 (sigma 15) `mshta` corpus 14 (sigma 14) `msiexec` corpus 5 (sigma 5) `process` corpus 5 (sigma 3, splunk 2) `regsvr32` corpus 15 (sigma 15) `rundll32` corpus 26 (sigma 23, chronicle 2, kusto 1) `verclsid` `wscript` corpus 16 (sigma 16)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\wbem\WMIC.exe`	`field:"Image" kind:ends_with value:"\wbem\WMIC.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 80 (sigma 38, elastic 24, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`
`ParentImage`	ends_with	`\EQNEDT32.EXE` corpus 5 (sigma 5) `\EXCEL.EXE` corpus 8 (sigma 8) `\MSACCESS.EXE` corpus 4 (sigma 4) `\MSPUB.exe` corpus 4 (sigma 4) `\ONENOTE.EXE` corpus 5 (sigma 5) `\POWERPNT.exe` corpus 6 (sigma 6) `\VISIO.exe` corpus 4 (sigma 4) `\WINWORD.EXE` corpus 10 (sigma 10) `\wordpad.exe` corpus 2 (sigma 2) `\wordview.exe` corpus 2 (sigma 2)	`field:"ParentImage" kind:ends_with`