Query: detect Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, in logs
Matching passage: Sigma rule: Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS,. Logsource: windows / process_creation. Rule: title: Uncommon System Information Discovery Via Wmic.EXE id: 9d5a1274-922a-49d0-87f3-8c653483b909 related: - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e type: derived status: test description: 'Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/ - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/ - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/ - https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior author: TropChaud date: 2023-01-26 modified: 2023-12-19 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection_wmic: - Description: WMI Commandline Utility - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_commands: CommandLine|contains: - LOGICALDISK get Name,Size,FreeSpace - os get Caption,OSArchitecture,Version condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: System Information Discovery with WMIC technique: T1082 atomic_guid: 8851b73a-3624-4bf7-8704-aa312411565c regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon/info.yml
Near-miss passage: Sigma rule: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem. Logsource: linux / process_creation. Rule: title: Container Residence Discovery Via Proc Virtual FS id: 746c86fb-ccda-4816-8997-01386263acc4 status: test description: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection_tools: Image|endswith: - awk - /cat - grep - /head - /less - /more - /nl - /tail selection_procfs_kthreadd: CommandLine|contains: /proc/2/ selection_procfs_target: CommandLine|contains: /proc/ CommandLine|endswith: - /cgroup - /sched condition: selection_tools and 1 of selection_procfs_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low