Create Remote Process via WMIC

Hypothesis and description

Adversaries may use Windows Management Instrumentation (WMI) to move laterally, by launching executables remotely.The analytic CAR-2014-12-001 describes how to detect these processes with network traffic monitoring and process monitoring on the target host. However, if the command line utility wmic.exe is used on the source host, then it can additionally be detected on an analytic. The command line on the source host is constructed into something like wmic.exe /node:"\<hostname\>" process call create "\<command line\>". It is possible to also connect via IP address, in which case the string "\<hostname\>" would instead look like IP Address.

Although this analytic was created after CAR-2014-12-001, it is a much simpler (although more limited) approach. Processes can be created remotely via WMI in a few other ways, such as more direct API access or the built-in utility PowerShell.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2016-03-28
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1047 Windows Management Instrumentation	Execution	Low

1 technique. Links open MITRE ATT&CK.

T1047Windows Management Instrumentation

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

Pseudocode

Looks for instances of wmic.exe as well as the substrings in the command line: * process call create * /node:

processes = search Process:Create
wmic = filter processes where (exe == "wmic.exe" and command_line == "* process call create *" and command_line == "* /node:*")
output wmic

SplunkData model: Sysmon native

Splunk version of the above pseudocode.

index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\*\\wmic.exe" CommandLine="* process call create *"|search CommandLine="* /node:*"

EQLData model: EQL native

EQL version of the above pseudocode.

process where subtype.create and
  (process_name == "wmic.exe" and command_line == "* process call create ")
  |filter command_line == "* /node:*"

LogPointData model: LogPoint native

LogPoint version of the above pseudocode.

norm_id=WindowsSysmon event_id=1 image="C:\\Windows\\*\\wmic.exe" command="* process call create *" command="* /node:*"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

5 more in the full list

View CAR-2016-03-002 on car.mitre.org

Hypothesis and description

Technique

Tactics

Coverage

T1047 Windows Management Instrumentation

Execution

Low