mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
66 lines
3.1 KiB
YAML
66 lines
3.1 KiB
YAML
name: Script Execution via WMI
|
|
id: aa73f80d-d728-4077-b226-81ea0c8be589
|
|
version: 5
|
|
date: '2024-05-11'
|
|
author: Rico Valdez, Michael Haag, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: |-
|
|
The following analytic detects the execution of scripts via Windows Management Instrumentation (WMI) by monitoring the process 'scrcons.exe'. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. WMI-based script execution is significant because adversaries often use it to perform malicious activities stealthily, such as system compromise, data exfiltration, or establishing persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain long-term access to the environment. Analysts should differentiate between legitimate administrative use and potential threats.
|
|
data_source:
|
|
- Sysmon EventID 1
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
|
|
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
|
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter`'
|
|
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
|
and Response (EDR) agents. These agents are designed to provide security-related
|
|
telemetry from the endpoints where the agent is installed. To implement this search,
|
|
you must ingest logs that contain the process GUID, process name, and parent process.
|
|
Additionally, you must ingest complete command-line executions. These logs must
|
|
be processed using the appropriate Splunk Technology Add-ons that are specific to
|
|
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
|
|
data model. Use the Splunk Common Information Model (CIM) to normalize the field
|
|
names and speed up the data modeling process.
|
|
known_false_positives: Although unlikely, administrators may use wmi to launch scripts
|
|
for legitimate purposes. Filter as needed.
|
|
references:
|
|
- https://redcanary.com/blog/child-processes/
|
|
tags:
|
|
analytic_story:
|
|
- Suspicious WMI Use
|
|
asset_type: Endpoint
|
|
confidence: 60
|
|
impact: 60
|
|
message: A wmic.exe process $process_name$ that execute script in host $dest$
|
|
mitre_attack_id:
|
|
- T1047
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.process_name
|
|
- Processes.user
|
|
- Processes.dest
|
|
risk_score: 36
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data:
|
|
https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|