{"id":"9d5a1274-922a-49d0-87f3-8c653483b909","title":"Uncommon System Information Discovery Via Wmic.EXE","description":"Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,\nincluding OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,\nand GPU driver products/versions.\nSome of these commands were used by Aurora Stealer in late 2022/early 2023.\n","author":"TropChaud","status":"test","level":"medium","date":"2023-01-26","modified":"2023-12-19","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic","https://nwgat.ninja/getting-system-information-with-wmic-on-windows/","https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar","https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/","https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/","https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml","source_sha256":"72240ed84eabe5671ef15607b5c7314a1520eb73496303514529cd4e2718a169","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Uncommon System Information Discovery Via Wmic.EXE\nid: 9d5a1274-922a-49d0-87f3-8c653483b909\nrelated:\n    - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e\n      type: derived\nstatus: test\ndescription: |\n    Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,\n    including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,\n    and GPU driver products/versions.\n    Some of these commands were used by Aurora Stealer in late 2022/early 2023.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic\n    - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/\n    - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar\n    - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/\n    - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/\n    - https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior\nauthor: TropChaud\ndate: 2023-01-26\nmodified: 2023-12-19\ntags:\n    - attack.discovery\n    - attack.t1082\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_wmic:\n        - Description: 'WMI Commandline Utility'\n        - OriginalFileName: 'wmic.exe'\n        - Image|endswith: '\\WMIC.exe'\n    selection_commands:\n        CommandLine|contains:\n            - 'LOGICALDISK get Name,Size,FreeSpace'\n            - 'os get Caption,OSArchitecture,Version'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\nsimulation:\n    - type: atomic-red-team\n      name: System Information Discovery with WMIC\n      technique: T1082\n      atomic_guid: 8851b73a-3624-4bf7-8704-aa312411565c\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/9d5a1274-922a-49d0-87f3-8c653483b909.json","kind":"sigma"}