{"id":"06ce37c2-61ab-4f05-9ff5-b1a96d18ae32","title":"WMIC Loading Scripting Libraries","description":"Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).\nIt could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.\n","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-10-17","modified":"2022-10-13","tags":["attack.stealth","attack.t1220"],"technique_ids":["T1220"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["The command wmic os get lastbootuptime loads vbscript.dll","The command wmic os get locale loads vbscript.dll","Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights","The command `wmic ntevent` loads vbscript.dll"],"references":["https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html","https://twitter.com/dez_/status/986614411711442944","https://lolbas-project.github.io/lolbas/Binaries/Wmic/"],"source_path":"rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml","source_sha256":"68fc03da6e14f5c2cb426af6c3f0642a40ada33dbace5f5051a08078d20b62ea","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WMIC Loading Scripting Libraries\nid: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32\nrelated:\n    - id: 8d63dadf-b91b-4187-87b6-34a1114577ea\n      type: similar\n    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d\n      type: similar\nstatus: test\ndescription: |\n    Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).\n    It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.\nreferences:\n    - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html\n    - https://twitter.com/dez_/status/986614411711442944\n    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/\nauthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)\ndate: 2020-10-17\nmodified: 2022-10-13\ntags:\n    - attack.stealth\n    - attack.t1220\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\wmic.exe'\n        ImageLoaded|endswith:\n            - '\\jscript.dll'\n            - '\\vbscript.dll'\n    condition: selection\nfalsepositives:\n    - The command wmic os get lastbootuptime loads vbscript.dll\n    - The command wmic os get locale loads vbscript.dll\n    - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights\n    - The command `wmic ntevent` loads vbscript.dll\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1220","id":"T1220","name":"XSL Script Processing","page":"techniques/enterprise/T1220/"}],"data_path":"data/detection-rules/06ce37c2-61ab-4f05-9ff5-b1a96d18ae32.json","kind":"sigma"}