1200kmSECURITY RESEARCH

1200KM / sigma-rule

WMIC Loading Scripting Libraries — Sigma Rule

Sigma rule 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32. WMIC Loading Scripting Libraries — Sigma Rule. Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.

Rule metadata and linked tags

testmediumimage_loadwindowsattack.stealthattack.t1220

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research). Source status: test; severity: medium. Source dates: 2020-10-17 / 2022-10-13.

{
  "category": "image_load",
  "product": "windows"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 68fc03da6e14f5c2cb426af6c3f0642a40ada33dbace5f5051a08078d20b62ea

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: WMIC Loading Scripting Libraries
id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
related:
    - id: 8d63dadf-b91b-4187-87b6-34a1114577ea
      type: similar
    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
      type: similar
status: test
description: |
    Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
    It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.
references:
    - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
    - https://twitter.com/dez_/status/986614411711442944
    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-10-17
modified: 2022-10-13
tags:
    - attack.stealth
    - attack.t1220
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        ImageLoaded|endswith:
            - '\jscript.dll'
            - '\vbscript.dll'
    condition: selection
falsepositives:
    - The command wmic os get lastbootuptime loads vbscript.dll
    - The command wmic os get locale loads vbscript.dll
    - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
    - The command `wmic ntevent` loads vbscript.dll
level: medium

Original YAML and metadata in JSON

False positives

  • The command wmic os get lastbootuptime loads vbscript.dll
  • The command wmic os get locale loads vbscript.dll
  • Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
  • The command `wmic ntevent` loads vbscript.dll

Source references

Connected ecosystem references

Exact source-tagged techniques

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.