Suspicious WSMAN Provider Image Loads

Severity: medium
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: upstream

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Lateral Movement	`T1021.003` Remote Services: Distributed Component Object Model

Event coverage

Provider	Event ID	Title
Sysmon	7	Image loaded

Stages and Predicates

Stage 1: `request_client`

or:
ImageLoaded|endswith: '\Microsoft.WSMan.Management.ni.dll'
ImageLoaded|endswith: '\WsmAuto.dll'
ImageLoaded|endswith: '\WsmSvc.dll'
OriginalFileName: Microsoft.WSMan.Management.dll
OriginalFileName: WSMANAUTOMATION.DLL
OriginalFileName: WsmSvc.dll

Stage 2: `respond_server`

Image|endswith: '\svchost.exe'
OriginalFileName: WsmWmiPl.dll

Stage 3: `not 1 of filter*`

or:
or:
Image|startswith: 'C:\Windows\Microsoft.NET\Framework64\v'
Image|startswith: 'C:\Windows\Microsoft.NET\FrameworkArm64\v'
Image|startswith: 'C:\Windows\Microsoft.NET\FrameworkArm\v'
Image|startswith: 'C:\Windows\Microsoft.NET\Framework\v'
Image|endswith: '\mscorsvw.exe'
CommandLine|contains: 'svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc'
CommandLine|contains: 'svchost.exe -k NetworkService -p -s Wecsvc'
CommandLine|contains: 'svchost.exe -k netsvcs -p -s BITS'
CommandLine|contains: 'svchost.exe -k netsvcs'
Image|endswith: '\mmc.exe'
Image: 'C:\Program Files (x86)\PowerShell\6\pwsh.exe'
Image: 'C:\Program Files (x86)\PowerShell\7\pwsh.exe'
Image: 'C:\Program Files\PowerShell\6\pwsh.exe'
Image: 'C:\Program Files\PowerShell\7\pwsh.exe'
Image: 'C:\Windows\System32\Configure-SMRemoting.exe'
Image: 'C:\Windows\System32\ServerManager.exe'
Image: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
Image: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
Image: 'C:\Windows\System32\sdiagnhost.exe'
Image: 'C:\Windows\System32\services.exe'
Image|startswith: 'C:\$WINDOWS.~BT\Sources\'
Image|startswith: 'C:\Program Files\Citrix\'
Image|startswith: 'C:\Windows\Temp\asgard2-agent\'

Stage 4: `not svchost`

Image|endswith: '\svchost.exe'

Stage 5: `not commandline_null`

CommandLine: null

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc` `svchost.exe -k NetworkService -p -s Wecsvc` `svchost.exe -k netsvcs` `svchost.exe -k netsvcs -p -s BITS`
`Image`	ends_with	`\mmc.exe` corpus 6 (sigma 6) `\mscorsvw.exe` corpus 2 (sigma 2) `\svchost.exe` corpus 20 (sigma 20)
`Image`	eq	`C:\Program Files (x86)\PowerShell\6\pwsh.exe` `C:\Program Files (x86)\PowerShell\7\pwsh.exe` `C:\Program Files\PowerShell\6\pwsh.exe` `C:\Program Files\PowerShell\7\pwsh.exe` corpus 4 (sigma 4) `C:\Windows\System32\Configure-SMRemoting.exe` `C:\Windows\System32\ServerManager.exe` corpus 3 (sigma 3) `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` corpus 4 (sigma 4) `C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe` corpus 3 (sigma 3) `C:\Windows\System32\sdiagnhost.exe` corpus 2 (sigma 2) `C:\Windows\System32\services.exe`
`Image`	starts_with	`C:\$WINDOWS.~BT\Sources\` `C:\Program Files\Citrix\` corpus 2 (sigma 2) `C:\Windows\Microsoft.NET\Framework64\v` `C:\Windows\Microsoft.NET\FrameworkArm64\v` `C:\Windows\Microsoft.NET\FrameworkArm\v` `C:\Windows\Microsoft.NET\Framework\v` `C:\Windows\Temp\asgard2-agent\` corpus 3 (sigma 3)
`ImageLoaded`	ends_with	`\Microsoft.WSMan.Management.ni.dll` `\WsmAuto.dll` `\WsmSvc.dll`
`OriginalFileName`	eq	`Microsoft.WSMan.Management.dll` `WSMANAUTOMATION.DLL` `WsmSvc.dll` `WsmWmiPl.dll`

Suspicious WSMAN Provider Image Loads

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: request_client

Stage 2: respond_server

Stage 3: not 1 of filter*