name: PowerShell Invoke CIMMethod CIMSession
id: 651ee958-a433-471c-b264-39725b788b83
version: 2
date: '2024-05-31'
author: Michael Haag, Splunk
type: Anomaly
status: production
data_source:
- Powershell Script Block Logging 4104
description: The following analytic detects the creation of a New-CIMSession cmdlet
  followed by the use of the Invoke-CIMMethod cmdlet within PowerShell. It leverages
  PowerShell Script Block Logging to identify these specific cmdlets in the ScriptBlockText
  field. This activity is significant because it mirrors the behavior of the Invoke-WMIMethod
  cmdlet, often used for remote code execution via NTLMv2 pass-the-hash authentication.
  If confirmed malicious, this could allow an attacker to execute commands remotely,
  potentially leading to unauthorized access and control over targeted systems.
search: '`powershell` EventCode=4104 ScriptBlockText IN ("*invoke-CIMMethod*", "*New-CimSession*")
  | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventCode
  ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `powershell_invoke_cimmethod_cimsession_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: False positives may be present based on third-party applications
  or administrators using CIM. It is recommended to apply appropriate filters as needed
  to minimize the number of false positives.
references:
- https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/invoke-cimmethod?view=powershell-7.3
tags:
  analytic_story:
  - Malicious PowerShell
  - Active Directory Lateral Movement
  asset_type: Endpoint
  confidence: 50
  impact: 50
  message: PowerShell was identified running a Invoke-CIMMethod Invoke-CIMSession
    on $Computer$.
  mitre_attack_id:
  - T1047
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - EventCode
  - ScriptBlockText
  - Computer
  risk_score: 25
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/4104-cimmethod-windows-powershell.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: xmlwineventlog