Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create

title: "Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create"
id: f14f8f9c-5f84-4eea-8adb-661c3bd263ec
status: test
description: This rule flags process executions of cscript.exe where the command line includes winrm-related activity to invoke a Create operation through wmicimv2/Win32_. It indicates an attempt to run winrm.vbs functionality for remote code execution or service creation on another host. The detection relies on Windows process creation telemetry, matching the image name, original file name, and required command-line substrings.
references:
  - https://twitter.com/bohops/status/994405551751815170
  - https://redcanary.com/blog/lateral-movement-winrm-wmi/
  - https://lolbas-project.github.io/lolbas/Scripts/Winrm/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml
author: Julia Fomina, oscd.community, Huntrule Team
date: 2020-10-07
modified: 2023-03-03
tags:
  - attack.stealth
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \cscript.exe
    - OriginalFileName: cscript.exe
  selection_cli:
    CommandLine|contains|all:
      - winrm
      - invoke Create wmicimv2/Win32_
      - -r:http
  condition: all of selection*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 9df0dd3a-1a5c-47e3-a2bc-30ed177646a0
    type: derived