Detection rules › YARA-L
Impacket WMIExec CISA Report
Detects the artifacts generally associated with the use of wmiexec.py
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1047 Windows Management Instrumentation |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaral
/*
* Copyright 2023 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
rule impacket_wmiexec_cisa_report {
meta:
author = "Google Cloud Security"
description = "Detects the artifacts generally associated with the use of wmiexec.py"
rule_id = "mr_ca682bc6-411b-46e5-88ef-1668032b14d1"
rule_name = "Impacket WMIExec CISA Report"
type = "alert"
data_source = "microsoft sysmon, microsoft windows events"
tactic = "TA0002"
technique = "T1047"
reference = "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"
severity = "Medium"
priority = "Medium"
events:
(
$process.metadata.event_type = "PROCESS_LAUNCH" and
re.regex($process.target.process.command_line, `1>.*\\ADMIN\$\\__.*2>&1`) nocase
)
or
(
$process.metadata.event_type = "FILE_CREATION" and
re.regex($process.target.file.full_path, `\\windows\\__`) nocase
)
$process.principal.hostname = $hostname
match:
$hostname over 5m
outcome:
$risk_score = 65
// added to populate alert graph with additional context
$principal_hostname = array_distinct($process.principal.hostname)
$principal_process_pid = array_distinct($process.principal.process.pid)
$principal_process_command_line = array_distinct($process.principal.process.command_line)
$principal_process_file_sha256 = array_distinct($process.principal.process.file.sha256)
$principal_process_file_full_path = array_distinct($process.principal.process.file.full_path)
$principal_process_product_specific_process_id = array_distinct($process.principal.process.product_specific_process_id)
$principal_process_parent_process_product_specific_process_id = array_distinct($process.principal.process.parent_process.product_specific_process_id)
$target_process_pid = array_distinct($process.target.process.pid)
$target_process_command_line = array_distinct($process.target.process.command_line)
$target_process_file_sha256 = array_distinct($process.target.process.file.sha256)
$target_process_file_full_path = array_distinct($process.target.process.file.full_path)
$target_process_product_specific_process_id = array_distinct($process.target.process.product_specific_process_id)
$principal_user_userid = array_distinct($process.principal.user.userid)
$target_user_userid = array_distinct($process.target.user.userid)
$target_file_full_path = array_distinct($process.target.file.full_path)
condition:
$process
}
Stages and Predicates
Stage 0: match + condition
match:
$hostname over 5m
condition:
$process
Fires when at least one $process event in the 5m window.
Stage 1: events: $process · PROCESS_LAUNCH
(
$process.metadata.event_type = "PROCESS_LAUNCH" and
re.regex($process.target.process.command_line, `1>.*\\ADMIN\$\\__.*2>&1`) nocase
)
or
(
$process.metadata.event_type = "FILE_CREATION" and
re.regex($process.target.file.full_path, `\\windows\\__`) nocase
)
$process.principal.hostname = $hostname
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
target.file.full_path | regex_match |
|
target.process.command_line | regex_match |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
risk_score | 65 |
principal_hostname | array_distinct($process.principal.hostname) |
principal_process_pid | array_distinct($process.principal.process.pid) |
principal_process_command_line | array_distinct($process.principal.process.command_line) |
principal_process_file_sha256 | array_distinct($process.principal.process.file.sha256) |
principal_process_file_full_path | array_distinct($process.principal.process.file.full_path) |
principal_process_product_specific_process_id | array_distinct($process.principal.process.product_specific_process_id) |
principal_process_parent_process_product_specific_process_id | array_distinct($process.principal.process.parent_process.product_specific_process_id) |
target_process_pid | array_distinct($process.target.process.pid) |
target_process_command_line | array_distinct($process.target.process.command_line) |
target_process_file_sha256 | array_distinct($process.target.process.file.sha256) |
target_process_file_full_path | array_distinct($process.target.process.file.full_path) |
target_process_product_specific_process_id | array_distinct($process.target.process.product_specific_process_id) |
principal_user_userid | array_distinct($process.principal.user.userid) |
target_user_userid | array_distinct($process.target.user.userid) |
target_file_full_path | array_distinct($process.target.file.full_path) |