Windows WMIC process creation with suspicious command execution

title: Windows WMIC process creation with suspicious command execution
id: 55eca7bb-9b2e-416b-bfb6-a561ac9943d5
related:
  - id: 526be59f-a573-4eea-b5f7-f0973207634d
    type: derived
  - id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8
    type: derived
status: test
description: This rule flags Windows process creation events where the command line includes WMIC-style process creation patterns and invokes secondary execution targets such as rundll32, regsvr32, bitsadmin, PowerShell/pwsh, certutil, and script hosts. Attackers abuse WMIC to indirectly spawn processes for execution and payload staging while blending into legitimate administration tooling. The detection relies on process creation telemetry, specifically the process command line contents captured at event time.
references:
  - https://thedfirreport.com/2020/10/08/ryuks-return/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2020-10-12
modified: 2023-02-14
tags:
  - attack.execution
  - attack.t1047
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - "process "
      - "call "
      - "create "
    CommandLine|contains:
      - rundll32
      - bitsadmin
      - regsvr32
      - "cmd.exe /c "
      - "cmd.exe /k "
      - "cmd.exe /r "
      - "cmd /c "
      - "cmd /k "
      - "cmd /r "
      - powershell
      - pwsh
      - certutil
      - cscript
      - wscript
      - mshta
      - \Users\Public\
      - \Windows\Temp\
      - \AppData\Local\
      - "%temp%"
      - "%tmp%"
      - "%ProgramData%"
      - "%appdata%"
      - "%comspec%"
      - "%localappdata%"
  condition: selection
falsepositives:
  - Unknown
level: high
simulation:
  - type: atomic red team
    name: WMI Execute rundll32
    technique: T1047
    atomic_guid: 00738d2a-4651-4d76-adf2-c43a41dfb243
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation/info.yml
license: DRL-1.1