{"id":"8a582fe2-0882-4b89-a82a-da6b2dc32937","title":"Suspicious WmiPrvSE Child Process","description":"Detects suspicious and uncommon child processes of WmiPrvSE","author":"Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-08-23","modified":"2023-11-10","tags":["attack.execution","attack.stealth","attack.t1047","attack.t1204.002","attack.t1218.010"],"technique_ids":["T1047","T1204.002","T1218.010"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml","https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/","https://twitter.com/ForensicITGuy/status/1334734244120309760"],"source_path":"rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml","source_sha256":"09dd26e7b73fea2c6510c356585b40abed67719faf1f8b401f01a5eecf3c430c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious WmiPrvSE Child Process\nid: 8a582fe2-0882-4b89-a82a-da6b2dc32937\nrelated:\n    - id: 692f0bec-83ba-4d04-af7e-e884a96059b6\n      type: similar\n    - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d\n      type: similar\n    - id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4\n      type: obsolete\nstatus: test\ndescription: Detects suspicious and uncommon child processes of WmiPrvSE\nreferences:\n    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n    - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\n    - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/\n    - https://twitter.com/ForensicITGuy/status/1334734244120309760\nauthor: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)\ndate: 2021-08-23\nmodified: 2023-11-10\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1047\n    - attack.t1204.002\n    - attack.t1218.010\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_parent:\n        ParentImage|endswith: '\\wbem\\WmiPrvSE.exe'\n    selection_children_1:\n        # TODO: Add more LOLBINs or suspicious processes that make sens in your environment\n        Image|endswith:\n            - '\\certutil.exe'\n            - '\\cscript.exe'\n            - '\\mshta.exe'\n            - '\\msiexec.exe'\n            - '\\regsvr32.exe'\n            - '\\rundll32.exe'\n            - '\\verclsid.exe'\n            - '\\wscript.exe'\n    selection_children_2:\n        # This is in a separate selection due to the nature of FP generated with CMD\n        Image|endswith: '\\cmd.exe'\n        CommandLine|contains:\n            - 'cscript'\n            - 'mshta'\n            - 'powershell'\n            - 'pwsh'\n            - 'regsvr32'\n            - 'rundll32'\n            - 'wscript'\n    filter_main_werfault:\n        Image|endswith: '\\WerFault.exe'\n    filter_main_wmiprvse:\n        Image|endswith: '\\WmiPrvSE.exe' # In some legitimate case WmiPrvSE was seen spawning itself\n    filter_main_msiexec:\n        Image|endswith: '\\msiexec.exe'\n        CommandLine|contains: '/i '\n    condition: selection_parent and 1 of selection_children_* and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"},{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","page":"techniques/enterprise/T1218.010/"}],"data_path":"data/detection-rules/8a582fe2-0882-4b89-a82a-da6b2dc32937.json","kind":"sigma"}