huntrule

Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments

Alerts on Office spawning WMIC.exe with process/create/call arguments and LOLBIN-like tool references.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Office-Launched WMIC with LOLBIN-Style Command Arguments"
id: eafdbe25-346d-41de-afa9-04d1aace68b1
related:
  - id: 438025f9-5856-4663-83f7-52f878a70a50
    type: derived
  - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a
    type: obsolete
  - id: 9d1c72f5-43f0-4da5-9320-648cf2099dd0
    type: obsolete
  - id: c0e1c3d5-4381-4f18-8145-2583f06a1fe5
    type: obsolete
  - id: 04f5363a-6bca-42ff-be70-0d28bf629ead
    type: obsolete
  - id: e1693bc8-7168-4eab-8718-cdcaa68a1738
    type: derived
status: test
description: This rule flags cases where a Microsoft Office application spawns WMIC.exe and supplies command-line arguments consistent with process creation via scripted/LOLBIN-like behavior (for example, containing combinations such as process, create, and call along with tools like regsvr32, rundll32, msiexec, mshta, verclsid, wscript, or cscript). Such activity is suspicious because attackers commonly use Office as an initial foothold and WMIC as an execution proxy to obscure the true parent-child relationship. It relies on Windows process creation telemetry, including parent process image paths, WMIC image/original filename, and WMIC command line contents.
references:
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml
author: Vadim Khrykov, Cyb3rEng, Huntrule Team
date: 2021-08-23
modified: 2023-02-14
tags:
  - attack.stealth
  - attack.t1204.002
  - attack.t1047
  - attack.t1218.010
  - attack.execution
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - \WINWORD.EXE
      - \EXCEL.EXE
      - \POWERPNT.exe
      - \MSPUB.exe
      - \VISIO.exe
      - \MSACCESS.EXE
      - \EQNEDT32.EXE
      - \ONENOTE.EXE
      - \wordpad.exe
      - \wordview.exe
  selection_wmic_img:
    - Image|endswith: \wbem\WMIC.exe
    - OriginalFileName: wmic.exe
  selection_wmic_cli:
    CommandLine|contains|all:
      - process
      - create
      - call
    CommandLine|contains:
      - regsvr32
      - rundll32
      - msiexec
      - mshta
      - verclsid
      - wscript
      - cscript
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags cases where a Microsoft Office application spawns WMIC.exe and supplies command-line arguments consistent with process creation via scripted/LOLBIN-like behavior (for example, containing combinations such as process, create, and call along with tools like regsvr32, rundll32, msiexec, mshta, verclsid, wscript, or cscript). Such activity is suspicious because attackers commonly use Office as an initial foothold and WMIC as an execution proxy to obscure the true parent-child relationship. It relies on Windows process creation telemetry, including parent process image paths, WMIC image/original filename, and WMIC command line contents.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.