cscli scenarios install sigmahq/proc_creation_win_wmiprvse_susp_child_processes1type: trigger2name: sigmahq/proc_creation_win_wmiprvse_susp_child_processes3description: |4 Detects suspicious and uncommon child processes of WmiPrvSE5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.ParentImage endsWith '\\wbem\\WmiPrvSE.exe' && (evt.Parsed.Image endsWith '\\certutil.exe' || evt.Parsed.Image endsWith '\\cscript.exe' || evt.Parsed.Image endsWith '\\mshta.exe' || evt.Parsed.Image endsWith '\\msiexec.exe' || evt.Parsed.Image endsWith '\\regsvr32.exe' || evt.Parsed.Image endsWith '\\rundll32.exe' || evt.Parsed.Image endsWith '\\verclsid.exe' || evt.Parsed.Image endsWith '\\wscript.exe' || evt.Parsed.Image endsWith '\\cmd.exe' && (evt.Parsed.CommandLine contains 'cscript' || evt.Parsed.CommandLine contains 'mshta' || evt.Parsed.CommandLine contains 'powershell' || evt.Parsed.CommandLine contains 'pwsh' || evt.Parsed.CommandLine contains 'regsvr32' || evt.Parsed.CommandLine contains 'rundll32' || evt.Parsed.CommandLine contains 'wscript')) && not (evt.Parsed.Image endsWith '\\WerFault.exe' || evt.Parsed.Image endsWith '\\WmiPrvSE.exe' || evt.Parsed.Image endsWith '\\msiexec.exe' && evt.Parsed.CommandLine contains '/i '))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t104715 - attack.t1204.00216 - attack.t1218.0101718 label: "Suspicious WmiPrvSE Child Process"19 behavior : "windows:audit"20 remediation: false2122scope:23 type: ParentProcessId24 expression: evt.Parsed.ParentProcessId2526