Windows WMIC Process Creation Recon for Unquoted Service Paths
Flags wmic.exe service queries requesting name/displayname/pathname/startmode to support unquoted service path reconnaissance.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-20
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of wmic.exe when it queries service information fields commonly used to identify unquoted service paths. Attackers and auditors can use this reconnaissance to locate weak service path configuration that may enable follow-on privilege escalation or service abuse. Telemetry relies on Windows process creation details including the executed image path/name and the command line contents.
Reporting behind it
- github.comhttps://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
- github.comhttps://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
- absolomb.comhttps://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WMIC Process Creation Recon for Unquoted Service Paths
id: 2c736a58-e28d-43ed-b36c-79f56494ef1a
related:
- id: 09658312-bc27-4a3b-91c5-e49ab9046d1b
type: similar
- id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
type: similar
- id: 68bcd73b-37ef-49cb-95fc-edc809730be6
type: derived
status: test
description: This rule identifies execution of wmic.exe when it queries service information fields commonly used to identify unquoted service paths. Attackers and auditors can use this reconnaissance to locate weak service path configuration that may enable follow-on privilege escalation or service abuse. Telemetry relies on Windows process creation details including the executed image path/name and the command line contents.
references:
- https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
- https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
- https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-09-11
tags:
- attack.execution
- attack.t1047
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: wmic.exe
- Image|endswith: \WMIC.exe
selection_cli:
CommandLine|contains|all:
- " service get "
- name,displayname,pathname,startmode
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search/info.yml
license: DRL-1.1