{"id":"7773b877-5abb-4a3e-b9c9-fd0369b59b00","title":"WMIC Remote Command Execution","description":"Detects the execution of WMIC to query information on a remote system","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-02-14","modified":"2025-10-22","tags":["attack.execution","attack.t1047"],"technique_ids":["T1047"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml","source_sha256":"fd30b2f3b7dc006e3c16a1695c3b7b56ad9b87e504323e855100a8f5d0bfbfd2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WMIC Remote Command Execution\nid: 7773b877-5abb-4a3e-b9c9-fd0369b59b00\nrelated:\n    - id: e42af9df-d90b-4306-b7fb-05c863847ebd\n      type: obsolete\n    - id: 09af397b-c5eb-4811-b2bb-08b3de464ebf\n      type: obsolete\nstatus: test\ndescription: Detects the execution of WMIC to query information on a remote system\nreferences:\n    - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/\n    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic\nauthor: frack113, Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-02-14\nmodified: 2025-10-22\ntags:\n    - attack.execution\n    - attack.t1047\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_cli:\n        CommandLine|contains|windash: '/node:'\n    filter_main_localhost:\n        CommandLine|contains:\n            - 'localhost'\n            - '127.0.0.1'\n    condition: all of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: medium\nsimulation:\n    - type: atomic-red-team\n      name: WMI Execute Remote Process\n      technique: T1047\n      atomic_guid: 9c8ef159-c666-472f-9874-90c8d60d136b\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_remote_execution/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"}],"data_path":"data/detection-rules/7773b877-5abb-4a3e-b9c9-fd0369b59b00.json","kind":"sigma"}