Local Groups Reconnaissance Via Wmic.EXE — Sigma Rule

Rule metadata and linked tags

Author: frack113. Source status: test; severity: low. Source dates: 2021-12-12 / 2023-02-14.

{
  "product": "windows",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: a57e3608848147ce1606b59cd56970cd65f087034c49beec4235fb254fb0665f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Local Groups Reconnaissance Via Wmic.EXE
id: 164eda96-11b2-430b-85ff-6a265c15bf32
status: test
description: |
    Detects the execution of "wmic" with the "group" flag.
    Adversaries may attempt to find local system groups and permission settings.
    The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
    Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
author: frack113
date: 2021-12-12
modified: 2023-02-14
tags:
    - attack.discovery
    - attack.t1069.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains: ' group'
    condition: all of selection*
falsepositives:
    - Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_group/info.yml

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md