Windows Security: Remote WMI DLL Hijack via wmiprvse—wbemcomn.dll placed in System32\wbem

title: "Windows Security: Remote WMI DLL Hijack via wmiprvse—wbemcomn.dll placed in System32\\wbem"
id: 4d825f30-f26d-445f-8427-f45603387c3c
status: test
description: This rule identifies attempts to create or write a DLL named wbemcomn.dll under C:\Windows\System32\wbem\ by matching Windows Security EventID 5145 activity targeting a path that ends with \wbem\wbemcomn.dll. Attackers may use this pattern to hijack WMI-related DLL loading as part of execution and lateral movement. The detection relies on network file share access telemetry from EventID 5145, plus filtering to exclude activity from machine accounts (SubjectUserName ending with $).
references:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), Huntrule Team
date: 2020-10-12
modified: 2022-02-24
tags:
  - attack.execution
  - attack.t1047
  - attack.lateral-movement
  - attack.t1021.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    RelativeTargetName|endswith: \wbem\wbemcomn.dll
  filter:
    SubjectUserName|endswith: $
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f6c68d5f-e101-4b86-8c84-7d96851fd65c
    type: derived