Windows wmiexec Default Output File Creation via File Events

title: Windows wmiexec Default Output File Creation via File Events
id: 68497868-8822-41ec-931e-05ce2e9c784d
status: test
description: This rule flags creation of the default output filenames typically produced by the wmiexec tool, matching specific Windows paths and a structured numeric pattern. Attackers may use wmiexec-style execution to run commands remotely and persist command output into predictable locations, making these files useful indicators of lateral movement or remote execution. The detection relies on Windows file creation events that populate TargetFilename, looking for the exact directory and filename pattern.
references:
  - https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
  - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-02
modified: 2023-03-08
tags:
  - attack.lateral-movement
  - attack.execution
  - attack.t1047
logsource:
  category: file_event
  product: windows
detection:
  selection:
    - TargetFilename|re: \\Windows\\__1\d{9}\.\d{1,7}$
    - TargetFilename|re: C:\\__1\d{9}\.\d{1,7}$
    - TargetFilename|re: D:\\__1\d{9}\.\d{1,7}$
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 8d5aca11-22b3-4f22-b7ba-90e60533e1fb
    type: derived