splunk-security_content/docs/_posts/2020-03-16-script_execution_via_wmi.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Script Execution via WMI	Windows Management Instrumentation	Endpoint	2020-03-16	true		TTP T1047 Windows Management Instrumentation Execution Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint Actions on Objectives

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This search looks for scripts launched via WMI.

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2020-03-16
• Author: Rico Valdez, Michael Haag, Splunk
• ID: aa73f80d-d728-4077-b226-81ea0c8be589

ATT&CK

ID	Technique	Tactic
T1047	Windows Management Instrumentation	Execution

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `script_execution_via_wmi_filter` 

Associated Analytic Story

• Suspicious WMI Use

How To Implement

You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.

Required field

• _time
• Processes.process_name
• Processes.user
• Processes.dest

Kill Chain Phase

• Actions on Objectives

Known False Positives

Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed.

RBA

Risk Score	Impact	Confidence	Message
36.0	60	60	A wmic.exe process process_name taht execute script in host dest

Reference

• https://redcanary.com/blog/child-processes/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/execution_scrcons/windows-sysmon.log

source | version: 4