huntrule

PowerShell Suspicious Win32_PnPEntity WMI Query on Windows

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

FreeUnreviewedSigmalowv1
title: PowerShell Suspicious Win32_PnPEntity WMI Query on Windows
id: d8c93bd8-35cc-495c-b258-abb60e24a9f7
status: test
description: This rule flags PowerShell script block content that contains the WMI class name Win32_PnPEntity. Adversaries can query Plug and Play device information during discovery to enumerate attached peripherals and components. Detection relies on PowerShell Script Block Logging telemetry that captures the executed script text.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1120/T1120.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml
author: frack113, Huntrule Team
date: 2021-08-23
modified: 2022-12-25
tags:
  - attack.discovery
  - attack.t1120
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: Win32_PnPEntity
  condition: selection
falsepositives:
  - Admin script
level: low
license: DRL-1.1
related:
  - id: b26647de-4feb-4283-af6b-6117661283c5
    type: derived

What it detects

This rule flags PowerShell script block content that contains the WMI class name Win32_PnPEntity. Adversaries can query Plug and Play device information during discovery to enumerate attached peripherals and components. Detection relies on PowerShell Script Block Logging telemetry that captures the executed script text.

Known false positives

  • Admin script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.