Application Termination Attempt via Wmic.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may use wmic to terminate security products or other applications on the compromised host. This event is triggered on on attempt and process creation can be either successful or unsuccessful.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Application Termination Attempt via Wmic.EXE
id: 49d9671b-0a0a-4c09-8280-d215bfd30662
related:
    - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 # Uninstall Security Products
      type: derived
status: test
description: |
    Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. Adversaries may
    use wmic to terminate security products or other applications on the compromised host. This event is
    triggered on on attempt and process creation can be either successful or unsuccessful.
references:
    - https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/
    - https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-11
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'call'
            - 'terminate'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_terminate_application/info.yml

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\WMIC.exe'
    - OriginalFileName: 'wmic.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'call'
        - 'terminate'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`call` corpus 8 (sigma 6, splunk 2) `terminate`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\WMIC.exe` corpus 62 (sigma 62)	`field:"Image" kind:ends_with value:"\WMIC.exe"`
`OriginalFileName`	eq	`wmic.exe` corpus 80 (sigma 38, elastic 24, splunk 18)	`field:"OriginalFileName" kind:eq value:"wmic.exe"`