WMI spwaning PowerShell process - WMImplant

Status: experimental
Severity: high
Log source: category process_creation, product windows
Author: Markus Neis/@Karneades, adapted by mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker WMIimplant

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1047` Windows Management Instrumentation

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: WMI spwaning PowerShell process - WMImplant
description: Detects scenarios where an attacker WMIimplant
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1047-Windows%20Management%20Instrumentation
- https://github.com/FortyNorthSecurity/WMImplant/
- https://www.darkoperator.com/blog/2017/10/14/basics-of-tracking-wmi-activity
- Inspired from https://github.com/SigmaHQ/sigma/blob/7bca85e40618126643b9712b80bd663c21908e26/rules/windows/process_creation/win_wmi_spwns_powershell.yml
tags:
- attack.execution
- attack.t1047
author: Markus Neis/@Karneades, adapted by mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:

  selection_basic:
    EventID: 4688
    Version: 2
    ParentProcessName|endswith: \WmiPrvSE.exe
    NewProcessName|endswith:
      - \powershell.exe
      - \pwsh.exe # PowerShell v6
      - \powershell_ise.exe # Development GUI


  selection_sysmon:
    EventID: 1
    ParentImage|endswith: \WmiPrvSE.exe
    Image|endswith|endswith:
      - \powershell.exe
      - \pwsh.exe # PowerShell v6
      - \powershell_ise.exe # Development GUI

  filter:
    CommandLine: "-" # Exclude empty command line

  condition: (selection_basic or selection_sysmon) and not filter
falsepositives:
- Unknown
level: high

Stages and Predicates

Stage 0: `condition`

(selection_basic or selection_sysmon) and not filter

Stage 1: `selection_basic`

selection_basic:
  EventID: 4688
  Version: 2
  ParentProcessName|endswith: \WmiPrvSE.exe
  NewProcessName|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \powershell_ise.exe

Stage 2: `selection_sysmon`

selection_sysmon:
  EventID: 1
  ParentImage|endswith: \WmiPrvSE.exe
  Image|endswith|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \powershell_ise.exe

Stage 3: `not filter`

filter:
  CommandLine: "-"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	eq	`-`	`excludes:CommandLine` `field:"CommandLine" value:"-"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\powershell_ise.exe` corpus 41 (sigma 41) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`NewProcessName`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\powershell_ise.exe` corpus 41 (sigma 41) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`ParentImage`	ends_with	`\WmiPrvSE.exe` corpus 8 (sigma 8)	`field:"ParentImage" kind:ends_with value:"\WmiPrvSE.exe"`
`ParentProcessName`	ends_with	`\WmiPrvSE.exe` corpus 3 (sigma 2, kusto 1)	`field:"parent_process_name" kind:ends_with value:"\WmiPrvSE.exe"`
`Version`	eq	`2` corpus 7 (sigma 7)	`field:"Version" kind:eq value:"2"`

WMI spwaning PowerShell process - WMImplant

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_basic

Stage 2: selection_sysmon

Stage 3: not filter

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection_basic`

Stage 2: `selection_sysmon`

Stage 3: `not filter`