SEKOIA.IO Rules high stable sigma

Impacket Wmiexec Module

Detection of impacket's wmiexec example, used by attackers to execute commands remotely.

View Source

Detection Logic

selection:
  process.parent.name: wmiprvse.exe
default1:
  process.command_line
| contains: \\127.0.0.1
default2:
  process.command_line
| re: .*\\__[0-9]{10}\.[0-9]{6}.*
default3:
  process.command_line
| contains: $ProgressPreference=
default4:
  process.command_line
| startswith: "cmd.exe /q /c "
condition: selection and 1 of default*

Field Validations

Loading…

Comments (0)

Loading comments...