Query: write Sigma for Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ
Matching passage: Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / file_event. Rule: title: Wmiprvse Wbemcomn DLL Hijack - File id: 614a7e17-5643-4d89-b6fe-f9df1a79641c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-12-02 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.. Logsource: windows / process_creation. Rule: title: System File Execution Location Anomaly id: e4a6b256-3e47-40fc-89d2-7a477edd6915 related: - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd type: derived status: test description: 'Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. ' references: - https://twitter.com/GelosSnake/status/934900723426439170 - https://asec.ahnlab.com/en/39828/ - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2017-11-27 modified: 2026-07-28 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \atbroker.exe - \audiodg.exe - \bcdedit.exe - \bitsadmin.exe - \certreq.exe - \certutil.exe - \cmstp.exe - \conhost.exe - \consent.exe - \cscript.exe - \csrss.exe - \dashost.exe - \defrag.exe - \dfrgui.exe - \dism.exe - \dllhost.exe - \dllhst3g.exe - \dwm.exe - \eventvwr.exe - \fsquirt.exe - \finger.exe - \logonui.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \ntoskrnl.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \runonce.exe - \RuntimeBroker.exe - \schtasks.exe - \services.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \userinit.exe - \werfault.exe - \werfaultsecure.exe - \wininit.exe - \winlogon.exe - \winver.exe - \wlanext.exe - \wmic.exe - \wscript.exe - \wsl.exe - \wsmprovhost.exe filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_optional_system32: Image|contains: \SystemRoot\System32\ filter_main_powershell: Image|contains: - C:\Program Files\PowerShell\7\ - C:\Program Files\PowerShell\7-preview\ - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_wsl_programfiles: Image|startswith: - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux - C:\Program Files\WSL\ Image|endswith: \wsl.exe filter_main_wsl_appdata: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\WindowsApps\ Image|endswith: \wsl.exe c