Query: detection rule: Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt
Matching passage: Sigma rule: Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt. Logsource: windows / process_creation. Rule: title: Process Creation Attempt via Wmic.EXE id: 526be59f-a573-4eea-b5f7-f0973207634d related: - id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 type: derived status: test description: 'Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful. ' references: - https://www.sans.org/blog/wmic-for-incident-response/ - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community date: 2019-01-16 modified: 2023-02-14 tags: - attack.execution - attack.t1047 - car.2016-03-002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - process - call - create condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic red team name: WMI Execute Local Process technique: T1047 atomic_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_process_creation/info.yml
Near-miss passage: Sigma rule: An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes,. Logsource: windows / process_creation. Rule: title: Service Reconnaissance Via Wmic.EXE id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae related: - id: 68bcd73b-37ef-49cb-95fc-edc809730be6 type: similar status: test description: 'An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2026-01-07 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: service filter_main_manipulation: CommandLine|contains: - stopservice - startservice filter_main_win32_methods: CommandLine|contains: - Change - Create - Delete - PauseService - ResumeService - SetSecurityDescriptor - StartService - StopService - UserControlService condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance List Remote Services technique: T1047 atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml