SigmaHQ/rules/windows/process_creation/win_wmi_spwns_powershell.yml

27 lines
801 B
YAML

title: WMI Spawning Windows PowerShell
status: experimental
description: Detects WMI spawning PowerShell
references:
- https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_shell_spawn_susp_program.yml
- https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e
author: Markus Neis / @Karneades
date: 2019/04/03
tags:
- attack.execution
- attack.defense_evasion
- attack.t1064
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage:
- '*\wmiprvse.exe'
Image:
- '*\powershell.exe'
condition: selection and not filter
falsepositives:
- AppvClient
- CCM
level: high