Windows WMIC Process Creation Recon for Unquoted Service Paths

title: Windows WMIC Process Creation Recon for Unquoted Service Paths
id: 2c736a58-e28d-43ed-b36c-79f56494ef1a
related:
  - id: 09658312-bc27-4a3b-91c5-e49ab9046d1b
    type: similar
  - id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
    type: similar
  - id: 68bcd73b-37ef-49cb-95fc-edc809730be6
    type: derived
status: test
description: This rule identifies execution of wmic.exe when it queries service information fields commonly used to identify unquoted service paths. Attackers and auditors can use this reconnaissance to locate weak service path configuration that may enable follow-on privilege escalation or service abuse. Telemetry relies on Windows process creation details including the executed image path/name and the command line contents.
references:
  - https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
  - https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2023-09-11
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: wmic.exe
    - Image|endswith: \WMIC.exe
  selection_cli:
    CommandLine|contains|all:
      - " service get "
      - name,displayname,pathname,startmode
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search/info.yml
license: DRL-1.1