Hub configuration

Name: Suspicious WMIC Execution Via Office Process
Author: sigmahq

More info

Suspicious WMIC Execution Via Office Process Detection Scenario by sigmahq | CrowdSec Hub

« Suspicious WMIC Execution Via Office Process »
v0.2 by sigmahq / proc_creation_win_wmic_susp_execution_via_office_process
Attack scenariowindowsNot spoofableLow confidence

Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Installation

cscli scenarios install sigmahq/proc_creation_win_wmic_susp_execution_via_office_process

YAML Configuration

1type: trigger
2name: sigmahq/proc_creation_win_wmic_susp_execution_via_office_process
3description: |
4  Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.ParentImage endsWith '\\WINWORD.EXE' || evt.Parsed.ParentImage endsWith '\\EXCEL.EXE' || evt.Parsed.ParentImage endsWith '\\POWERPNT.exe' || evt.Parsed.ParentImage endsWith '\\MSPUB.exe' || evt.Parsed.ParentImage endsWith '\\VISIO.exe' || evt.Parsed.ParentImage endsWith '\\MSACCESS.EXE' || evt.Parsed.ParentImage endsWith '\\EQNEDT32.EXE' || evt.Parsed.ParentImage endsWith '\\ONENOTE.EXE' || evt.Parsed.ParentImage endsWith '\\wordpad.exe' || evt.Parsed.ParentImage endsWith '\\wordview.exe') && (evt.Parsed.Image endsWith '\\wbem\\WMIC.exe' || evt.Parsed.OriginalFileName == 'wmic.exe') && evt.Parsed.CommandLine contains 'process' && evt.Parsed.CommandLine contains 'create' && evt.Parsed.CommandLine contains 'call' && (evt.Parsed.CommandLine contains 'regsvr32' || evt.Parsed.CommandLine contains 'rundll32' || evt.Parsed.CommandLine contains 'msiexec' || evt.Parsed.CommandLine contains 'mshta' || evt.Parsed.CommandLine contains 'verclsid' || evt.Parsed.CommandLine contains 'wscript' || evt.Parsed.CommandLine contains 'cscript'))
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1204.002
15   - attack.t1047
16   - attack.t1218.010
17
18  label: "Suspicious WMIC Execution Via Office Process"
19  behavior : "windows:audit"
20  remediation: false
21
22scope:
23  type: ParentProcessId
24  expression: evt.Parsed.ParentProcessId
25
26

Hub configuration

« Suspicious WMIC Execution Via Office Process »v0.2 by sigmahq / proc_creation_win_wmic_susp_execution_via_office_processAttack scenariowindowsNot spoofableLow confidenceMITRE:t1204MITRE:t1047MITRE:t1218

« Suspicious WMIC Execution Via Office Process »
v0.2 by sigmahq / proc_creation_win_wmic_susp_execution_via_office_process
Attack scenariowindowsNot spoofableLow confidence