Detection of Malicious PowerShell CIM Session Abuse

This detection focuses on identifying the abuse of Common Information Model (CIM) cmdlets within PowerShell, specifically 'New-CIMSession' and 'Invoke-CIMMethod'. These cmdlets are standard administrative tools used to interact with Windows Management Instrumentation (WMI), but they are frequently repurposed by adversaries to execute commands on remote systems. This technique mirrors the behavior historically associated with 'Invoke-WMIMethod', which is often utilized for lateral movement, pass-the-hash attacks, and remote command execution within Windows environments. Defenders should monitor PowerShell Script Block Logging (Event ID 4104) to identify instances where these cmdlets are executed in sequence, as this is a high-signal indicator of unauthorized administrative-style activity.

Attack Chain

1. Attacker gains initial access to a compromised host within the domain.
2. Attacker performs internal reconnaissance to identify high-value targets or servers.
3. Attacker uses compromised credentials to initiate a remote session using 'New-CIMSession'.
4. Attacker executes malicious payloads on the remote target using 'Invoke-CIMMethod'.
5. The WMI service on the target system executes the requested method.
6. If successful, the attacker achieves arbitrary code execution on the remote system.
7. Attacker continues lateral movement or data exfiltration from the compromised remote system.

Impact

Successful abuse of these cmdlets can lead to unauthorized remote code execution, full system compromise, and further lateral movement throughout an Active Directory environment. This behavior is commonly associated with threat actors engaged in targeted intrusions and data theft, where stealthy administrative commands are preferred to bypass traditional security controls.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) on all endpoints to capture the full execution context of scripts.
• Deploy the provided Sigma rule to identify the sequence of 'New-CIMSession' and 'Invoke-CIMMethod' being invoked within the same script block.
• Establish a baseline for legitimate administrative usage of CIM cmdlets in your environment to reduce false positives during investigation.
• Investigate occurrences of these cmdlets, particularly when initiated by non-administrative users or from unauthorized source machines.