Query: rule covering An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes,
Matching passage: Sigma rule: An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes,. Logsource: windows / process_creation. Rule: title: Service Reconnaissance Via Wmic.EXE id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae related: - id: 68bcd73b-37ef-49cb-95fc-edc809730be6 type: similar status: test description: 'An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2026-01-07 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: service filter_main_manipulation: CommandLine|contains: - stopservice - startservice filter_main_win32_methods: CommandLine|contains: - Change - Create - Delete - PauseService - ResumeService - SetSecurityDescriptor - StartService - StopService - UserControlService condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance List Remote Services technique: T1047 atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml
Near-miss passage: Sigma rule: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the w. Logsource: windows / registry_set. Rule: title: Suspicious Execution Of Renamed Sysinternals Tools - Registry id: f50f3c09-557d-492d-81db-9064a8d4e211 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 8023f872-3f1d-4301-a384-801889917ab4 type: similar status: test description: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \ProcDump - \Process Explorer - \PsExec - \PsLoggedon - \PsLoglist - \PsPasswd - \PsPing - \PsService - \SDelete TargetObject|endswith: \EulaAccepted filter: Image|endswith: - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \PsLoggedon.exe - \PsLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \PsPing.exe - \PsPing64.exe - \PsPing64a.exe - \PsService.exe - \PsService64.exe - \PsService64a.exe - \sdelete.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml