Detection rules › Splunk
Remote WMIC Query (Sysmon)
An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement. This use case detects execution of WMIC commands with the '/node' switch, indicating potential remote operations or information gathering attempts on network endpoints
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '20368.36066'
title: Remote WMIC Query
description: 'An adversary can use WMI to interact with local and remote systems and
use it as a means to execute various behaviors, such as gathering information for
Discovery as well as remote Execution of files as part of Lateral Movement. This
use case detects execution of WMIC commands with the ''/node'' switch, indicating
potential remote operations or information gathering attempts on network endpoints.
-- Threat Actor Association: Earth Estries, Flax Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` ((TERM(EventCode=1) OR "<EventID>1<")
(TERM(wmic) OR "wmic.exe") OR "/node:" | regex process="(?i)/node:" | table _time,
host, user process, process_*, parent_* | bin span=1s | stats values(*) as * by
_time, host '
techniques:
- execution:windows management instrumentation
technique_id:
- T1047
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/