{"id":"e1693bc8-7168-4eab-8718-cdcaa68a1738","title":"Suspicious WMIC Execution Via Office Process","description":"Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).","author":"Vadim Khrykov, Cyb3rEng","status":"test","level":"high","date":"2021-08-23","modified":"2023-02-14","tags":["attack.stealth","attack.t1204.002","attack.t1047","attack.t1218.010","attack.execution"],"technique_ids":["T1047","T1204.002","T1218.010"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/","https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml"],"source_path":"rules/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml","source_sha256":"b154793dc16b5c76ca61ef93d5bb471dfa4cd04cb7f3d49139092e0d48c91f4f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious WMIC Execution Via Office Process\nid: e1693bc8-7168-4eab-8718-cdcaa68a1738\nrelated:\n    - id: 438025f9-5856-4663-83f7-52f878a70a50\n      type: derived\n    - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a\n      type: obsolete\n    - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0\n      type: obsolete\n    - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5\n      type: obsolete\n    - id: 04f5363a-6bca-42ff-be70-0d28bf629ead\n      type: obsolete\nstatus: test\ndescription: Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).\nreferences:\n    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/\n    - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml\nauthor: Vadim Khrykov, Cyb3rEng\ndate: 2021-08-23\nmodified: 2023-02-14\ntags:\n    - attack.stealth\n    - attack.t1204.002\n    - attack.t1047\n    - attack.t1218.010\n    - attack.execution\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_parent:\n        ParentImage|endswith:\n            - '\\WINWORD.EXE'\n            - '\\EXCEL.EXE'\n            - '\\POWERPNT.exe'\n            - '\\MSPUB.exe'\n            - '\\VISIO.exe'\n            - '\\MSACCESS.EXE'\n            - '\\EQNEDT32.EXE'\n            - '\\ONENOTE.EXE'\n            - '\\wordpad.exe'\n            - '\\wordview.exe'\n    selection_wmic_img:\n        - Image|endswith: '\\wbem\\WMIC.exe'\n        - OriginalFileName: 'wmic.exe'\n    selection_wmic_cli:\n        CommandLine|contains|all:\n            - 'process'\n            - 'create'\n            - 'call'\n        CommandLine|contains:\n            # Add more suspicious LOLBINs as you see fit\n            - 'regsvr32'\n            - 'rundll32'\n            - 'msiexec'\n            - 'mshta'\n            - 'verclsid'\n            - 'wscript'\n            - 'cscript'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1047","id":"T1047","name":"Windows Management Instrumentation","page":"techniques/enterprise/T1047/"},{"key":"enterprise/T1204.002","id":"T1204.002","name":"Malicious File","page":"techniques/enterprise/T1204.002/"},{"key":"enterprise/T1218.010","id":"T1218.010","name":"Regsvr32","page":"techniques/enterprise/T1218.010/"}],"data_path":"data/detection-rules/e1693bc8-7168-4eab-8718-cdcaa68a1738.json","kind":"sigma"}