Wmi

This brief documents the detection of WMI 'process call create' command-line patterns used by adversaries to execute arbitrary payloads and maintain persistence.

Attackers utilize the MOFComp utility to compile Managed Object Format (MOF) files for establishing WMI event subscriptions, enabling persistence, lateral movement, or arbitrary code execution on Windows systems.

Adversaries leverage the Windows Management Instrumentation (WMI) utility (wmic.exe) to facilitate lateral movement and remote code execution by spawning unauthorized processes on target systems.

Detection of unauthorized or suspicious process spawning from WmiPrvSE.exe, a common technique for lateral movement, remote code execution, and persistence via Windows Management Instrumentation.

This brief details the detection of potential lateral movement and remote code execution via the abuse of 'New-CIMSession' and 'Invoke-CIMMethod' cmdlets in PowerShell.

Adversaries leverage the Impacket wmiexec.py tool to facilitate lateral movement and remote code execution by spawning processes via wmiprvse.exe using distinct command-line obfuscation and hidden share access patterns.

This brief outlines the detection of potential persistence and privilege escalation via WMI permanent event subscriptions, which attackers use to trigger malicious payloads on system events.

Adversaries leverage WMI permanent event subscriptions to achieve stealthy persistence and arbitrary code execution by binding system event filters to malicious consumers.

Adversaries leverage WMI token impersonation to gain elevated privileges, a behavior detectable by monitoring specific process access masks requested by wmiprvse.exe.

This brief documents a detection method for the use of PowerShell to trigger MSI installations through the WMI Win32_Product class, a technique often utilized for software deployment or unauthorized persistence.

Adversaries utilize PowerShell commands to query WMI objects and check for virtualization artifacts to evade sandbox and analysis environments.

This brief outlines the detection of Windows Management Instrumentation (WMI) event subscriptions used by attackers for persistence and privilege escalation.

Adversaries utilize PowerShell to establish persistence and achieve privilege escalation by creating WMI event subscriptions that execute malicious payloads upon system triggers.

Adversaries can utilize PowerShell to programmatically create Volume Shadow Copies, enabling the offline extraction of sensitive files like the Active Directory ntds.dit database.

This brief details the detection of suspicious PowerShell script execution that targets the discovery of installed anti-virus and anti-spyware products using WMI or PowerShell commands, a common reconnaissance tactic employed by malicious actors to map security applications and potentially evade defenses.

Attackers are leveraging `wmic.exe` to modify the Windows registry through the WMI `StdRegProv` class, specifically using methods like `CreateKey` and `SetStringValue`, to evade detection and bypass traditional security monitoring focused on `reg.exe` or `regedit.exe`.

The rule identifies the use of Windows Management Instrumentation StdRegProv (registry provider) to modify commonly abused registry locations for persistence by detecting registry changes made by WmiPrvSe.exe in specific registry paths.

The StealthyWMIExec.py script facilitates lateral movement via WMI, potentially evading standard detection mechanisms by employing stealthy techniques.

Attackers use WMI permanent event subscriptions to execute malicious scripts or binaries for persistence by creating event consumers other than the default NTEventLogEventConsumer.

Adversaries may exploit Windows Management Instrumentation (WMI) to execute code stealthily, bypassing traditional security measures by loading `wmiutils.dll` from Microsoft Office applications, potentially indicating malicious execution.

Detects suspicious command execution via WMI on a Windows host, potentially indicating lateral movement by an adversary using cmd.exe to execute commands remotely.

This analytic detects suspicious PowerShell activity leveraging WMI to gather system information, potentially indicating reconnaissance by an attacker.

This rule detects suspicious execution of system enumeration commands by the Windows Management Instrumentation Provider Service (WMIPrvSE), indicating potential reconnaissance or malicious activity on Windows systems.

Adversaries leverage Windows Management Instrumentation (WMI) to establish persistence by creating event subscriptions that trigger malicious code execution when specific events occur, often utilizing `wmic.exe` to create event consumers.

Detection of processes executed via Windows Management Instrumentation (WMI) on a remote host indicating potential adversary lateral movement.

The rule identifies the use of Windows script interpreters (cscript.exe or wscript.exe) executing a process via Windows Management Instrumentation (WMI), which may indicate malicious activity, especially when initiated by non-system accounts.

Attackers may leverage the mofcomp.exe utility to compile malicious MOF files, enabling them to manipulate the Windows Management Instrumentation (WMI) repository for persistence or execution of arbitrary code.

Detection of WMI temporary event subscriptions via Windows Event Logs can identify potential attacker command execution, information gathering, or persistence attempts.

This threat brief details the detection of malicious Windows Management Instrumentation (WMI) event subscriptions, a technique used by attackers for persistence and privilege escalation on Windows systems.

Detection of wmic.exe execution with parameters indicative of spawning a process on a remote system, a technique often used for lateral movement and remote code execution.

This rule identifies suspicious activity where enumeration commands are spawned via the Windows Management Instrumentation Provider Service (WMIPrvSE) to gather system and network information.