Sigma high test sigma

Potentially Suspicious Mofcomp Execution

Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts

View Source

Detection Logic

{
  "selection_img": [
    {
      "Image
| endswith": "\\mofcomp.exe"
    },
    {
      "OriginalFileName": "mofcomp.exe"
    }
  ],
  "selection_case": [
    {
      "ParentImage
| endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wsl.exe",
        "\\wscript.exe",
        "\\cscript.exe"
      ]
    },
    {
      "CommandLine
| contains": [
        "\\AppData\\Local\\Temp",
        "\\Contacts\\",
        "\\Favorites\\",
        "\\Favourites\\",
        "\\Music\\",
        "\\Pictures\\",
        "\\Users\\Public\\",
        "\\Videos\\",
        "\\WINDOWS\\Temp\\",
        "%appdata%",
        "%temp%",
        "%tmp%"
      ]
    }
  ],
  "filter_main_wmiprvse": {
    "ParentImage": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
    "CommandLine
| contains": "C:\\Windows\\TEMP\\",
    "CommandLine
| endswith": ".mof"
  },
  "filter_main_installutil": {
    "ParentCommandLine
| endswith": "\\InstallUtil.exe /Uninstall C:\\Windows\\CCM\\Microsoft.ConfigurationManager.SVProvider.dll",
    "ParentImage
| endswith": "\\InstallUtil.exe",
    "CommandLine
| contains
| all": [
      "C:\\Windows\\TEMP",
      ".tmp"
    ]
  },
  "filter_optional_null_parent": {
    "ParentCommandLine": null
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

False Positives

  • ⚠ Unknown

Field Validations

Loading…

Comments (0)

Loading comments...