Elastic low stable eql

Unusual Process Execution on WBEM Path

Identifies unusual processes running from the WBEM path, uncommon outside WMI-related Windows processes.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and
  process.executable : ("?:\\Windows\\System32\\wbem\\*", "?:\\Windows\\SysWow64\\wbem\\*") and
  not process.name : (
    "mofcomp.exe",
    "scrcons.exe",
    "unsecapp.exe",
    "wbemtest.exe",
    "winmgmt.exe",
    "wmiadap.exe",
    "wmiapsrv.exe",
    "wmic.exe",
    "wmiprvse.exe"
  )

Field Validations

Loading…

Comments (0)

Loading comments...