SEKOIA.IO Rules high stable sigma

Wmic Process Call Creation

The WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands. Although WMI is supposed to be an administration tool, it is wildy abused by threat actors. One of the reasons is WMI is quite stealthy. This rule detects the wmic command line launching a process on a remote or local host.

View Source

Detection Logic

process_wmic:
  process.command_line
| contains
| all:
    - process
    - call
    - create
  process.name: "*"
filter:
  - process.name: crashpad_handler.exe
  - process.executable: /bin/rm
condition: process_wmic and not filter

Field Validations

Loading…

Comments (0)

Loading comments...