Detection rules › Splunk
Remote WMIC Query (Windows Event Log)
An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement. This use case detects execution of WMIC commands with the '/node' switch, indicating potential remote operations or information gathering attempts on network endpoints
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
id: '20368.36065'
title: Remote WMIC Query
description: 'An adversary can use WMI to interact with local and remote systems and
use it as a means to execute various behaviors, such as gathering information for
Discovery as well as remote Execution of files as part of Lateral Movement. This
use case detects execution of WMIC commands with the ''/node'' switch, indicating
potential remote operations or information gathering attempts on network endpoints.
-- Threat Actor Association: Earth Estries, Flax Typhoon'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) (TERM(wmic) OR "wmic.exe") OR "/node:" | regex
process="(?i)/node:" | table _time, host, user process, process_*, parent_* | bin
span=1s | stats values(*) as * by _time, host '
techniques:
- execution:windows management instrumentation
technique_id:
- T1047
data_category:
- Process command-line parameters
- Windows event logs
references:
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) (TERM(wmic) OR "wmic.exe") OR "/node:"
Stage 2: regex
| regex process="(?i)/node:"
Stage 3: table
| table _time, host, user process, process_*, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"4688" |
process | regex_match |
| field:"CommandLine" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>4688<" |
| 1 | wmic |
| 1 | "wmic.exe" |
| 1 | "/node:" |