Detection rules › Splunk
System Enumeration with WMIC (Windows Event Log)
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This use case detects several WMIC executions in a short period of time
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1047 Windows Management Instrumentation |
| Discovery | T1082 System Information Discovery |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
id: '16967.27502'
title: System Enumeration with WMIC
description: 'An adversary may attempt to get detailed information about the operating
system and hardware, including version, patches, hotfixes, service packs, and architecture.
Adversaries may use the information from System Information Discovery during automated
discovery to shape follow-on behaviors, including whether or not the adversary fully
infects the target and/or attempts specific actions. This use case detects several
WMIC executions in a short period of time. -- Threat Actor Association: Volt Typhoon
-- Atomics T1082 Test #25'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR
"<EventID>4688<" OR Type=Process) TERM(wmic) OR "wmic.exe" | table _time, host,
user, process, process_*, parent_process*| regex process_name="(?i)wmic"| bin span=120s
| stats values(*) as * by _time, host | eventstats dc(process) as dc_process by
host, _time| where dc_process > 5 '
techniques:
- discovery:system information discovery
- execution:windows management instrumentation
technique_id:
- T1082
- T1047
data_category:
- Windows event logs
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=4688) OR "<EventID>4688<" OR Type=Process) TERM(wmic) OR "wmic.exe"
Stage 2: table
| table _time, host, user, process, process_*, parent_process*
Stage 3: regex
| regex process_name="(?i)wmic"
Stage 4: bucket
| bin span=120s
Stage 5: stats
| stats values(*) as * by _time, host
Stage 6: eventstats
| eventstats dc(process) as dc_process by host, _time
Stage 7: where
| where dc_process > 5
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
dc_process | gt |
|
process_name | regex_match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>4688<" |
| 1 | TERM |
| 1 | wmic |
| 1 | "wmic.exe" |