{"id":"10c14723-61c7-4c75-92ca-9af245723ad2","title":"HackTool - Potential Impacket Lateral Movement Activity","description":"Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework","author":"Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch","status":"stable","level":"high","date":"2019-09-03","modified":"2023-02-21","tags":["attack.execution","attack.t1047","attack.lateral-movement","attack.t1021.003"],"technique_ids":["T1021.003","T1047"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py","https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py","https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py","https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py","https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml","source_sha256":"7cbff6f540a01c19a171e61cd3b15088eced4bd78018df83447cb97242017828","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Potential Impacket Lateral Movement Activity\nid: 10c14723-61c7-4c75-92ca-9af245723ad2\nrelated:\n    - id: e31f89f7-36fb-4697-8ab6-48823708353b\n      type: obsolete\nstatus: stable\ndescription: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework\nreferences:\n    - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py\n    - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py\n    - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py\n    - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py\n    - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html\nauthor: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch\ndate: 2019-09-03\nmodified: 2023-02-21\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.lateral-movement\n    - attack.t1021.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_other:\n        # *** wmiexec.py\n        #    parent is wmiprvse.exe\n        #    examples:\n        #       cmd.exe /Q /c whoami 1> \\\\127.0.0.1\\ADMIN$\\__1567439113.54 2>&1\n        #       cmd.exe /Q /c cd  1> \\\\127.0.0.1\\ADMIN$\\__1567439113.54 2>&1\n        # *** dcomexec.py -object MMC20\n        #   parent is mmc.exe\n        #   example:\n        #       \"C:\\Windows\\System32\\cmd.exe\" /Q /c cd  1> \\\\127.0.0.1\\ADMIN$\\__1567442499.05 2>&1\n        # *** dcomexec.py -object ShellBrowserWindow\n        #  runs %SystemRoot%\\System32\\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} but parent command is explorer.exe\n        #  example:\n        #   \"C:\\Windows\\System32\\cmd.exe\" /Q /c cd \\ 1> \\\\127.0.0.1\\ADMIN$\\__1567520103.71 2>&1\n        # *** smbexec.py\n        #   parent is services.exe\n        #   example:\n        #       C:\\Windows\\system32\\cmd.exe /Q /c echo tasklist ^> \\\\127.0.0.1\\C$\\__output 2^>^&1 > C:\\Windows\\TEMP\\execute.bat & C:\\Windows\\system32\\cmd.exe /Q /c C:\\Windows\\TEMP\\execute.bat & del C:\\Windows\\TEMP\\execute.bat\n        ParentImage|endswith:\n            - '\\wmiprvse.exe'        # wmiexec\n            - '\\mmc.exe'        # dcomexec MMC\n            - '\\explorer.exe'        # dcomexec ShellBrowserWindow\n            - '\\services.exe'        # smbexec\n        CommandLine|contains|all:\n            - 'cmd.exe'\n            - '/Q'\n            - '/c'\n            - '\\\\\\\\127.0.0.1\\\\'\n            - '&1'\n    selection_atexec:\n        ParentCommandLine|contains:\n            - 'svchost.exe -k netsvcs'       # atexec on win10 (parent is \"C:\\Windows\\system32\\svchost.exe -k netsvcs\")\n            - 'taskeng.exe'       # atexec on win7 (parent is \"taskeng.exe {AFA79333-694C-4BEE-910E-E57D9A3518F6} S-1-5-18:NT AUTHORITY\\System:Service:\")\n            # cmd.exe /C tasklist /m > C:\\Windows\\Temp\\bAJrYQtL.tmp 2>&1\n        CommandLine|contains|all:\n            - 'cmd.exe'\n            - '/C'\n            - 'Windows\\Temp\\'\n            - '&1'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.003","id":"T1021.003","name":"Distributed Component Object Model","page":"techniques/enterprise/T1021.003/"},{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"}],"data_path":"data/detection-rules/10c14723-61c7-4c75-92ca-9af245723ad2.json","kind":"sigma"}