Query: detect Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on ru in logs
Matching passage: Sigma rule: Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on ru. Logsource: windows / process_creation. Rule: title: Potential Process Reconnaissance via Wmic.EXE id: 221b251a-357a-49a9-920a-271802777cc0 status: test description: 'Detects the execution of "wmic" with the "process" flag, which might indicate an attempt to perform reconnaissance on running processes. Adversaries may use wmic to query for running processes and their details as part of their reconnaissance efforts. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: frack113 date: 2022-01-01 modified: 2025-12-15 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1057 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: process filter_main_creation: CommandLine|contains|all: - call - create filter_main_terminate: CommandLine|contains|all: - call - terminate condition: all of selection* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance Processes technique: T1047 atomic_guid: 5750aa16-0e59-4410-8b9a-8a47ca2788e2 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_process/info.yml
Near-miss passage: Sigma rule: Detects scenarios where one can control another users or computers account without having to use their credentials.. Logsource: windows / security. Rule: title: Active Directory User Backdoors id: 300bac00-e041-4ee2-9c36-e262656a6ecc status: test description: Detects scenarios where one can control another users or computers account without having to use their credentials. references: - https://msdn.microsoft.com/en-us/library/cc220234.aspx - https://adsecurity.org/?p=3466 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-04-13 modified: 2024-02-26 tags: - attack.privilege-escalation - attack.t1098 - attack.persistence logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\DS Access\Audit Directory Service Changes' detection: selection1: EventID: 4738 filter_empty: AllowedToDelegateTo: - '' - '-' filter_null: AllowedToDelegateTo: null selection_5136_1: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToDelegateTo selection_5136_2: EventID: 5136 ObjectClass: user AttributeLDAPDisplayName: servicePrincipalName selection_5136_3: EventID: 5136 AttributeLDAPDisplayName: msDS-AllowedToActOnBehalfOfOtherIdentity condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_* falsepositives: - Unknown level: high