Windows Network File Drop: wbemcomn.dll in System32\wbem for WMI DLL Hijack

Alerts when System creates wbemcomn.dll in C:\Windows\System32\wbem\, consistent with WMI DLL hijack file staging.

FreeUnreviewedSigmacriticalv1

windows-network-file-drop-wbemcomn-dll-in-system32-wbem-for-wmi-dll-hijack-614a7e17

title: "Windows Network File Drop: wbemcomn.dll in System32\\wbem for WMI DLL Hijack"
id: edcf49e3-345a-42c9-8950-5858f6d2febc
status: test
description: This rule flags creation of a file named wbemcomn.dll under C:\Windows\System32\wbem\ when the creating process is System. Attackers can use DLL hijacking to redirect WMI-related execution paths and load attacker-controlled libraries, enabling persistence or lateral movement. The detection relies on Windows file event telemetry that records the creating process (Image=System) and the full target filename path ending in \wbem\wbemcomn.dll.
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-10-12
modified: 2022-12-02
tags:
  - attack.execution
  - attack.t1047
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image: System
    TargetFilename|endswith: \wbem\wbemcomn.dll
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 614a7e17-5643-4d89-b6fe-f9df1a79641c
    type: derived

What it detects

This rule flags creation of a file named wbemcomn.dll under C:\Windows\System32\wbem\ when the creating process is System. Attackers can use DLL hijacking to redirect WMI-related execution paths and load attacker-controlled libraries, enabling persistence or lateral movement. The detection relies on Windows file event telemetry that records the creating process (Image=System) and the full target filename path ending in \wbem\wbemcomn.dll.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.