Detection rules › Sigma

WmiPrvSE Spawned A Process

Status
stable
Severity
medium
Log source
category process_creation, product windows
Author
Roberto Rodriguez @Cyb3rWard0g
Source
github.com/SigmaHQ/sigma

Detects WmiPrvSE spawning a process

Known false positives

  • False positives are expected (e.g. in environments where WinRM is used legitimately)

MITRE ATT&CK coverage

Telemetry coverage

Rule body

title: WmiPrvSE Spawned A Process
id: d21374ff-f574-44a7-9998-4a8c8bf33d7d
related:
    - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937
      type: similar
    - id: 692f0bec-83ba-4d04-af7e-e884a96059b6
      type: similar
status: stable
description: Detects WmiPrvSE spawning a process
references:
    - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-15
modified: 2023-03-23
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\WmiPrvSe.exe'
    filter_logonid:
        LogonId:
            - '0x3e7'  # LUID 999 for SYSTEM
            - 'null'   # too many false positives
    filter_system_user:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    filter_wmiprvse:
        Image|endswith: '\WmiPrvSE.exe'
    filter_werfault:
        Image|endswith: '\WerFault.exe'
    filter_null:  # some backends need the null value in a separate expression
        LogonId: null
    condition: selection and not 1 of filter_*
falsepositives:
    - False positives are expected (e.g. in environments where WinRM is used legitimately)
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_*

Stage 1: selection

selection:
    ParentImage|endswith: '\WmiPrvSe.exe'

Stage 2: not filter_*

filter_logonid:
    LogonId:
        - '0x3e7'
        - 'null'
filter_system_user:
    User|contains:
        - 'AUTHORI'
        - 'AUTORI'
filter_wmiprvse:
    Image|endswith: '\WmiPrvSE.exe'
filter_werfault:
    Image|endswith: '\WerFault.exe'
filter_null:
    LogonId: null

Exclusions

The rule actively suppresses these predicates.

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ParentImageends_with
  • \WmiPrvSe.exe corpus 8 (sigma 8)
field:"ParentImage" kind:ends_with value:"\WmiPrvSe.exe"