SigmaHQ/rules/windows/process_creation/win_susp_wmi_execution.yml

title: Suspicious WMI Execution
id: 526be59f-a573-4eea-b5f7-f0973207634d
status: experimental
description: Detects WMI executing suspicious commands
references:
    - https://digital-forensics.sans.org/blog/2010/06/04/wmic-draft/
    - https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1
    - https://blog.malwarebytes.com/threat-analysis/2016/04/rokku-ransomware/
author: Michael Haag, Florian Roth, juju4, oscd.community
date: 2019/01/16
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\wmic.exe'
    selection2:
        - CommandLine|contains|all:
            - '/NODE:'
            - 'process call create '
        - CommandLine|contains:
            - ' path AntiVirusProduct get '
            - ' path FirewallProduct get '
            - ' shadowcopy delete '
    condition: selection and selection2
fields:
    - CommandLine
    - ParentCommandLine
tags:
    - attack.execution
    - attack.t1047
    - car.2016-03-002
falsepositives:
    - Will need to be tuned
    - If using Splunk, I recommend | stats count by Computer,CommandLine following for easy hunting by Computer/CommandLine.
level: medium