{"id":"8d63dadf-b91b-4187-87b6-34a1114577ea","title":"Potential Remote SquiblyTwo Technique Execution","description":"Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)\nto execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process\nmalicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.\nThe attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it\nwith full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common\nLOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.\n","author":"Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"high","date":"2019-01-16","modified":"2026-01-24","tags":["attack.stealth","attack.t1047","attack.t1220","attack.execution","attack.t1059.005","attack.t1059.007"],"technique_ids":["T1047","T1059.005","T1059.007","T1220"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html","https://twitter.com/mattifestation/status/986280382042595328","https://atomicredteam.io/defense-evasion/T1220/","https://lolbas-project.github.io/lolbas/Binaries/Wmic/","https://x.com/byrne_emmy12099/status/1932346420226658668"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","source_sha256":"7df38f73821d5a863b50441d4b4e4361c97c1fa175862f7f3a8df01b9a7912ff","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Remote SquiblyTwo Technique Execution\nid: 8d63dadf-b91b-4187-87b6-34a1114577ea\nrelated:\n    - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32\n      type: similar\n    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d\n      type: similar\nstatus: test\ndescription: |\n    Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)\n    to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process\n    malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.\n    The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it\n    with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common\n    LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.\nreferences:\n    - https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html\n    - https://twitter.com/mattifestation/status/986280382042595328 # Deleted\n    - https://atomicredteam.io/defense-evasion/T1220/\n    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/\n    - https://x.com/byrne_emmy12099/status/1932346420226658668\nauthor: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)\ndate: 2019-01-16\nmodified: 2026-01-24\ntags:\n    - attack.stealth\n    - attack.t1047\n    - attack.t1220\n    - attack.execution\n    - attack.t1059.005\n    - attack.t1059.007\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_pe:\n        - Image|endswith: '\\wmic.exe'\n        - OriginalFileName: 'wmic.exe'\n        - Hashes|contains:  # Sysmon field hashes contains all types\n              - 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'\n              - 'IMPHASH=37777A96245A3C74EB217308F3546F4C'\n              - 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'\n              - 'IMPHASH=B12619881D79C3ACADF45E752A58554A'\n              - 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'\n    selection_cli:\n        CommandLine|contains|windash: '/format:'\n        CommandLine|contains:\n            - '://'\n            - '\\\\\\\\'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"},{"key":"enterprise/T1059.007","id":"T1059.007","name":"JavaScript","page":"techniques/enterprise/T1059.007/"},{"key":"enterprise/T1220","id":"T1220","name":"XSL Script Processing","page":"techniques/enterprise/T1220/"}],"data_path":"data/detection-rules/8d63dadf-b91b-4187-87b6-34a1114577ea.json","kind":"sigma"}