Remote WMIC Query (PowerShell)

id: '20368.36103'
title: Remote WMIC Query
description: 'An adversary can use WMI to interact with local and remote systems and
  use it as a means to execute various behaviors, such as gathering information for
  Discovery as well as remote Execution of files as part of Lateral Movement. This
  use case detects execution of WMIC commands with the ''/node'' switch, indicating
  potential remote operations or information gathering attempts on network endpoints.
  -- Threat Actor Association: Earth Estries, Flax Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<" OR TERM(EventCode=4104) OR "<EventID>4104<") (TERM(wmic) OR "wmic.exe")
  OR "/node:" | regex process="(?i)/node:" | table _time, host, user process, process_*,
  parent_* | bin span=1s | stats values(*) as * by _time, host '
techniques:
- execution:windows management instrumentation
technique_id: 
- T1047
data_category:
- PowerShell logs
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/