splunk-security_content/detections/wmi_script_execution.json

{
  "asset_type": "Endpoint",
  "confidence": "medium",
  "creation_date": "2018-10-23",
  "data_metadata": {
    "data_models": [
      "Endpoint"
    ],
    "data_source": [
      "Endpoint Intel"
    ],
    "providing_technologies": [
      "Carbon Black Response",
      "Sysmon",
      "Tanium",
      "Ziften"
    ]
  },
  "description": "This search looks for scripts launched via WMI.",
  "detect": {
    "splunk": {
      "correlation_rule": {
        "notable": {
          "nes_fields": "dest, user, process",
          "rule_description": "This search looks for scrcons.exe, which indicates that a script was launched via WMI.",
          "rule_title": "Script execution via WMI on $dest$"
        },
        "risk": {
          "risk_object": "dest",
          "risk_object_type": [
            "system"
          ],
          "risk_score": 70
        },
        "schedule": {
          "cron_schedule": "0 * * * *",
          "earliest_time": "-70m@m",
          "latest_time": "-10m@m"
        },
        "search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = \"scrcons.exe\" by Processes.user Processes.dest Processes.process_name  | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`",
        "suppress": {
          "suppress_fields": "dest,process",
          "suppress_period": "28800s"
        }
      }
    }
  },
  "eli5": "Attackers are increasingly abusing Windows Management Infrastructure for stealth, persistence, lateral movement, or just to leverage its functionality. This search looks for scripts launched via WMI, either remotely or locally, by looking for the execution of scrcons.exe, which is the scripting host used by WMI, similar to wscript or cscript.",
  "entities": [
    "dest"
  ],
  "how_to_implement": "You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the \"process\" field in the Endpoint data model.",
  "id": "aa73f80d-d728-4077-b226-81ea0c8be589",
  "investigations": [
    {
      "id": "155e0571-7db6-42f2-aa62-9a3a4cf35c94",
      "name": "Get Sysmon WMI Activity for Host",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd76",
      "name": "Get Authentication Logs For Endpoint",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d55",
      "name": "Get Risk Modifiers For User",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd71",
      "name": "Get Process Info",
      "type": "splunk"
    },
    {
      "id": "3d6c3213-5fff-4a1e-b57d-b24c262171e7",
      "name": "Get Notable History",
      "type": "splunk"
    },
    {
      "id": "f3fb4d1b-5f33-4b01-b541-c7af9534c242",
      "name": "Get Notable Info",
      "type": "splunk"
    },
    {
      "id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
      "name": "Get Risk Modifiers For Endpoint",
      "type": "splunk"
    },
    {
      "id": "bc91a8cf-35e7-4bb2-8140-e756cc06fd74",
      "name": "Get User Information from Identity Table",
      "type": "splunk"
    }
  ],
  "known_false_positives": "Although unlikely, administrators may use wmi to launch scripts for legitimate purposes.",
  "maintainers": [
    {
      "company": "Splunk",
      "email": "rvaldez@splunk.com",
      "name": "Rico Valdez"
    }
  ],
  "mappings": {
    "cis20": [
      "CIS 3",
      "CIS 5"
    ],
    "kill_chain_phases": [
      "Actions on Objectives"
    ],
    "mitre_attack": [
      "Execution",
      "Windows Management Instrumentation"
    ],
    "nist": [
      "PR.PT",
      "PR.AT",
      "PR.AC",
      "PR.IP"
    ]
  },
  "modification_date": "2019-03-01",
  "name": "Script Execution via WMI",
  "original_authors": [
    {
      "company": "Splunk",
      "email": "rvaldez@splunk.com",
      "name": "Rico Valdez"
    }
  ],
  "references": [],
  "security_domain": "endpoint",
  "spec_version": 2,
  "type": "splunk",
  "version": "2.0"
}