Query: Sigma rule for Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS,
Matching passage: Sigma rule: Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS,. Logsource: windows / process_creation. Rule: title: Uncommon System Information Discovery Via Wmic.EXE id: 9d5a1274-922a-49d0-87f3-8c653483b909 related: - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e type: derived status: test description: 'Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/ - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/ - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/ - https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior author: TropChaud date: 2023-01-26 modified: 2023-12-19 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection_wmic: - Description: WMI Commandline Utility - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_commands: CommandLine|contains: - LOGICALDISK get Name,Size,FreeSpace - os get Caption,OSArchitecture,Version condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: System Information Discovery with WMIC technique: T1082 atomic_guid: 8851b73a-3624-4bf7-8704-aa312411565c regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon/info.yml
Near-miss passage: Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low