{"id":"76f55eaa-d27f-4213-9d45-7b0e4b60bbae","title":"Service Reconnaissance Via Wmic.EXE","description":"An adversary might use WMI to check if a certain remote service is running on a remote device.\nWhen the test completes, a service information will be displayed on the screen if it exists.\nA common feedback message is that \"No instance(s) Available\" if the service queried is not running.\nA common error message is \"Node - (provided IP or default) ERROR Description =The RPC server is unavailable\" if the provided remote host is unreachable\n","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":"2026-01-07","tags":["attack.execution","attack.t1047"],"technique_ids":["T1047"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic","https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml","source_sha256":"dcd0c5a604e97ccf0c4b8e451033195c41c36a3ee1fa45e3a27c98d38a3aaf5b","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_service.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Service Reconnaissance Via Wmic.EXE\nid: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae\nrelated:\n    - id: 68bcd73b-37ef-49cb-95fc-edc809730be6\n      type: similar\nstatus: test\ndescription: |\n    An adversary might use WMI to check if a certain remote service is running on a remote device.\n    When the test completes, a service information will be displayed on the screen if it exists.\n    A common feedback message is that \"No instance(s) Available\" if the service queried is not running.\n    A common error message is \"Node - (provided IP or default) ERROR Description =The RPC server is unavailable\" if the provided remote host is unreachable\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic\n    - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-02-14\nmodified: 2026-01-07\ntags:\n    - attack.execution\n    - attack.t1047\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        CommandLine|contains: 'service'\n    filter_main_manipulation:\n        # Duplicate with 0b7163dc-7eee-4960-af17-c0cd517f92da\n        CommandLine|contains:\n            - 'stopservice'\n            - 'startservice'\n    filter_main_win32_methods:\n        CommandLine|contains:\n            - 'Change'\n            - 'Create'\n            - 'Delete'\n            - 'PauseService'\n            - 'ResumeService'\n            - 'SetSecurityDescriptor'\n            - 'StartService'\n            - 'StopService'\n            - 'UserControlService'\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\nsimulation:\n    - type: atomic-red-team\n      name: WMI Reconnaissance List Remote Services\n      technique: T1047\n      atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"}],"data_path":"data/detection-rules/76f55eaa-d27f-4213-9d45-7b0e4b60bbae.json","kind":"sigma"}