Recon Information for Export with Command Prompt

Severity: medium
Author: frack113
Source: upstream

Once established within a system or network, an adversary may use automated techniques for collecting internal data.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1119` Automated Collection

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_image`

or:
Image|endswith: '\WMIC.exe'
Image|endswith: '\doskey.exe'
Image|endswith: '\sc.exe'
Image|endswith: '\tree.com'
OriginalFileName: DOSKEY.EXE
OriginalFileName: sc.exe
OriginalFileName: wmic.exe

Stage 2: `all of selection_redirect`

or:
ParentCommandLine|contains: ' > %TEMP%\'
ParentCommandLine|contains: ' > %TMP%\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Image`	ends_with	`\WMIC.exe` corpus 12 (sigma 12) `\doskey.exe` `\sc.exe` corpus 17 (sigma 17) `\tree.com`
`OriginalFileName`	eq	`DOSKEY.EXE` `sc.exe` corpus 10 (sigma 10) `wmic.exe` corpus 33 (sigma 33)
`ParentCommandLine`	match	`> %TEMP%\` `> %TMP%\`