{"id":"3c89a1e8-0fba-449e-8f1b-8409d6267ec8","title":"Suspicious Process Created Via Wmic.EXE","description":"Detects WMIC executing \"process call create\" with suspicious calls to processes such as \"rundll32\", \"regsrv32\", etc.","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-10-12","modified":"2023-02-14","tags":["attack.execution","attack.t1047"],"technique_ids":["T1047"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2020/10/08/ryuks-return/","https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml","source_sha256":"88d4ab0c508378b528bc49aa93222fad6e197e89933c2f43721847cb9208f60d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Process Created Via Wmic.EXE\nid: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8\nrelated:\n    - id: 526be59f-a573-4eea-b5f7-f0973207634d # Generic\n      type: derived\nstatus: test\ndescription: Detects WMIC executing \"process call create\" with suspicious calls to processes such as \"rundll32\", \"regsrv32\", etc.\nreferences:\n    - https://thedfirreport.com/2020/10/08/ryuks-return/\n    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2020-10-12\nmodified: 2023-02-14\ntags:\n    - attack.execution\n    - attack.t1047\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'process '\n            - 'call '\n            - 'create '\n        CommandLine|contains:\n            # Add more susupicious paths and binaries as you see fit in your env\n            - 'rundll32'\n            - 'bitsadmin'\n            - 'regsvr32'\n            - 'cmd.exe /c '\n            - 'cmd.exe /k '\n            - 'cmd.exe /r '\n            - 'cmd /c '\n            - 'cmd /k '\n            - 'cmd /r '\n            - 'powershell'\n            - 'pwsh'\n            - 'certutil'\n            - 'cscript'\n            - 'wscript'\n            - 'mshta'\n            - '\\Users\\Public\\'\n            - '\\Windows\\Temp\\'\n            - '\\AppData\\Local\\'\n            - '%temp%'\n            - '%tmp%'\n            - '%ProgramData%'\n            - '%appdata%'\n            - '%comspec%'\n            - '%localappdata%'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\nsimulation:\n    - type: atomic red team\n      name: WMI Execute rundll32\n      technique: T1047\n      atomic_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"}],"data_path":"data/detection-rules/3c89a1e8-0fba-449e-8f1b-8409d6267ec8.json","kind":"sigma"}