Detection rules › Splunk
System Enumeration with WMIC (Sysmon)
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This use case detects several WMIC executions in a short period of time
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Discovery |
References
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
id: '16967.27503'
title: System Enumeration with WMIC
description: 'An adversary may attempt to get detailed information about the operating
system and hardware, including version, patches, hotfixes, service packs, and architecture.
Adversaries may use the information from System Information Discovery during automated
discovery to shape follow-on behaviors, including whether or not the adversary fully
infects the target and/or attempts specific actions. This use case detects several
WMIC executions in a short period of time. -- Threat Actor Association: Volt Typhoon
-- Atomics T1082 Test #25'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
TERM(wmic) OR "wmic.exe" | table _time, host, user, process, process_*, parent_process*|
regex process_name="(?i)wmic"| bin span=120s | stats values(*) as * by _time, host
| eventstats dc(process) as dc_process by host, _time| where dc_process > 5 '
techniques:
- discovery:system information discovery
- execution:windows management instrumentation
technique_id:
- T1082
- T1047
data_category:
- Windows Sysmon
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") TERM(wmic) OR "wmic.exe"
Stage 2: table
| table _time, host, user, process, process_*, parent_process*
Stage 3: regex
| regex process_name="(?i)wmic"
Stage 4: bucket
| bin span=120s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: eventstats
| eventstats dc(process) as dc_process by host, _time
Stage 7: where
| where dc_process > 5
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
EventCode | eq |
| field:"EventID" kind:eq value:"1" |
dc_process | gt |
| field:"dc_process" kind:gt value:"5" |
process_name | regex_match |
| field:"process_name" kind:regex_match |
Search terms
These SPL tokens match against raw event text.
| Stage | Term |
|---|---|
| 1 | "<EventID>1<" |
| 1 | wmic |
| 1 | "wmic.exe" |