{"id":"692f0bec-83ba-4d04-af7e-e884a96059b6","title":"Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell","description":"Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.","author":"Markus Neis @Karneades","status":"stable","level":"medium","date":"2019-04-03","modified":"2023-03-29","tags":["attack.execution","attack.t1047","attack.t1059.001"],"technique_ids":["T1047","T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["AppvClient","CCM","WinRM"],"references":["https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e"],"source_path":"rules/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml","source_sha256":"03b197a9213815c30ca191879b4665434edaef354a72551063f7aaffad0f991d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell\nid: 692f0bec-83ba-4d04-af7e-e884a96059b6\nrelated:\n    - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937\n      type: similar\n    - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d\n      type: similar\nstatus: stable\ndescription: Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.\nreferences:\n    - https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e\nauthor: Markus Neis @Karneades\ndate: 2019-04-03\nmodified: 2023-03-29\ntags:\n    - attack.execution\n    - attack.t1047\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\WmiPrvSE.exe'\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    condition: all of selection_*\nfalsepositives:\n    - AppvClient\n    - CCM\n    - WinRM\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/692f0bec-83ba-4d04-af7e-e884a96059b6.json","kind":"sigma"}