name: Windows PowerShell Get CIMInstance Remote Computer
id: d8c972eb-ed84-431a-8869-ca4bd83257d1
version: 2
date: '2024-05-23'
author: Michael Haag, Splunk
type: Anomaly
status: production
data_source:
- Powershell Script Block Logging 4104
description: The following analytic detects the use of the Get-CimInstance cmdlet
  with the -ComputerName parameter, indicating an attempt to retrieve information
  from a remote computer. It leverages PowerShell Script Block Logging to identify
  this specific command execution. This activity is significant as it may indicate
  unauthorized remote access or information gathering by an attacker. If confirmed
  malicious, this could allow the attacker to collect sensitive data from remote systems,
  potentially leading to further exploitation or lateral movement within the network.
search: '`powershell` EventCode=4104 ScriptBlockText="*get-ciminstance*" AND ScriptBlockText="*computername*"  |
  stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
  Computer user_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
  | `windows_powershell_get_ciminstance_remote_computer_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: This is meant to be a low risk RBA anomaly analytic or to be
  used for hunting. Enable this with a low risk score and let it generate risk in
  the risk index.
references:
- https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance?view=powershell-7.3
tags:
  analytic_story:
  - Active Directory Lateral Movement
  asset_type: Endpoint
  confidence: 50
  impact: 30
  message: A PowerShell Cmdlet Get-CIMInstnace was ran on $Computer$, attempting to
    connect to a remote host.
  mitre_attack_id:
  - T1059.001
  observable:
  - name: Computer
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - ScriptBlockText
  - Computer
  - EventCode
  risk_score: 15
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/get_ciminstance_windows-powershell.log
    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
    sourcetype: xmlwineventlog