Query: write Sigma for Detects suspicious and uncommon child processes of WmiPrvSE
Matching passage: Sigma rule: Detects suspicious and uncommon child processes of WmiPrvSE. Logsource: windows / process_creation. Rule: title: Suspicious WmiPrvSE Child Process id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 related: - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d type: similar - id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4 type: obsolete status: test description: Detects suspicious and uncommon child processes of WmiPrvSE references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/ForensicITGuy/status/1334734244120309760 author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) date: 2021-08-23 modified: 2023-11-10 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: \wbem\WmiPrvSE.exe selection_children_1: Image|endswith: - \certutil.exe - \cscript.exe - \mshta.exe - \msiexec.exe - \regsvr32.exe - \rundll32.exe - \verclsid.exe - \wscript.exe selection_children_2: Image|endswith: \cmd.exe CommandLine|contains: - cscript - mshta - powershell - pwsh - regsvr32 - rundll32 - wscript filter_main_werfault: Image|endswith: \WerFault.exe filter_main_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_main_msiexec: Image|endswith: \msiexec.exe CommandLine|contains: '/i ' condition: selection_parent and 1 of selection_children_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / ps_module. Rule: title: Alternate PowerShell Hosts - PowerShell Module id: 64e8e417-c19a-475a-8d19-98ea705394cc status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-11 modified: 2025-10-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: '*' filter_powershell: ContextInfo|contains: - = powershell - = C:\Windows\System32\WindowsPowerShell\v1.0\powershell - = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell - = C:/Windows/System32/WindowsPowerShell/v1.0/powershell - = C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell - = \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell - = \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell filter_sdiagnhost: ContextInfo|contains: = C:\WINDOWS\System32\sdiagnhost.exe -Embedding filter_citrix: ContextInfo|contains: ConfigSyncRun.exe filter_adace: ContextInfo|contains: C:\Windows\system32\dsac.exe filter_winrm: ContextInfo|contains: C:\Windows\system32\wsmprovhost.exe -Embedding filter_help_update: Payload|contains: - Update-Help - Failed to update Help for the module condition: selection and not 1 of filter_* falsepositives: - Programs using PowerShell directly without invocation of a dedicated interpreter - MSP Detection Searcher - Citrix ConfigSync.ps1 level: medium