Detection rules › Sigma

Potential Remote SquiblyTwo Technique Execution

Severity
high
Author
Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
Source
upstream

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1047 Windows Management Instrumentation, T1059.005 Command and Scripting Interpreter: Visual Basic, T1059.007 Command and Scripting Interpreter: JavaScript
Defense EvasionT1220 XSL Script Processing

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_pe

or:
Hashes|contains: 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'
Hashes|contains: 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
Hashes|contains: 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
Hashes|contains: 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
Hashes|contains: 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
Image|endswith: '\wmic.exe'
OriginalFileName: wmic.exe

Stage 2: all of selection_cli

or:
CommandLine|contains: '://'
CommandLine|contains: '\\\\'
CommandLine|contains: '/format:'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /format:
  • :// corpus 4 (sigma 4)
  • \\\\ corpus 7 (sigma 7)
Hashesmatch
  • IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 corpus 2 (sigma 2)
  • IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E corpus 2 (sigma 2)
  • IMPHASH=37777A96245A3C74EB217308F3546F4C corpus 2 (sigma 2)
  • IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 corpus 2 (sigma 2)
  • IMPHASH=B12619881D79C3ACADF45E752A58554A corpus 2 (sigma 2)
Imageends_with
  • \wmic.exe corpus 37 (sigma 37)
OriginalFileNameeq
  • wmic.exe corpus 33 (sigma 33)