mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Bhavin Patel
65 lines
3.2 KiB
YAML
65 lines
3.2 KiB
YAML
name: Script Execution via WMI
|
|
id: aa73f80d-d728-4077-b226-81ea0c8be589
|
|
version: 4
|
|
date: '2020-03-16'
|
|
author: Rico Valdez, Michael Haag, Splunk
|
|
status: production
|
|
type: TTP
|
|
description: |-
|
|
The following analytic detects any potential misuse of Windows Management Instrumentation (WMI) for malicious purposes since adversaries often use WMI to run scripts which allows them to carry out malicious activities without raising suspicion. The detection is made by monitoring the process 'scrcons.exe', which is essential to run WMI scripts. The detection is important because it proactively identifies and responds to potential threats that leverage WMI for malicious purposes that can lead to system compromise, data exfiltration, or the establishment of persistence within the environment. False positives might occur since administrators might occasionally use WMI to launch scripts for legitimate purposes. Therefore, you must distinguish between malicious and benign activities.
|
|
data_source:
|
|
- Sysmon Event ID 1
|
|
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
|
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe
|
|
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
|
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
|
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` '
|
|
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
|
and Response (EDR) agents. These agents are designed to provide security-related
|
|
telemetry from the endpoints where the agent is installed. To implement this search,
|
|
you must ingest logs that contain the process GUID, process name, and parent process.
|
|
Additionally, you must ingest complete command-line executions. These logs must
|
|
be processed using the appropriate Splunk Technology Add-ons that are specific to
|
|
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
|
|
data model. Use the Splunk Common Information Model (CIM) to normalize the field
|
|
names and speed up the data modeling process.
|
|
known_false_positives: Although unlikely, administrators may use wmi to launch scripts
|
|
for legitimate purposes. Filter as needed.
|
|
references:
|
|
- https://redcanary.com/blog/child-processes/
|
|
tags:
|
|
analytic_story:
|
|
- Suspicious WMI Use
|
|
asset_type: Endpoint
|
|
confidence: 60
|
|
impact: 60
|
|
message: A wmic.exe process $process_name$ that execute script in host $dest$
|
|
mitre_attack_id:
|
|
- T1047
|
|
observable:
|
|
- name: dest
|
|
type: Hostname
|
|
role:
|
|
- Victim
|
|
- name: user
|
|
type: User
|
|
role:
|
|
- Victim
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
required_fields:
|
|
- _time
|
|
- Processes.process_name
|
|
- Processes.user
|
|
- Processes.dest
|
|
risk_score: 36
|
|
security_domain: endpoint
|
|
tests:
|
|
- name: True Positive Test
|
|
attack_data:
|
|
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log
|
|
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
|
sourcetype: xmlwineventlog
|