Detection rules › Sigma
Potential Remote SquiblyTwo Technique Execution
Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.
MITRE ATT&CK coverage
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: all of selection_pe
or:
Hashes|contains: 'IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00'
Hashes|contains: 'IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E'
Hashes|contains: 'IMPHASH=37777A96245A3C74EB217308F3546F4C'
Hashes|contains: 'IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206'
Hashes|contains: 'IMPHASH=B12619881D79C3ACADF45E752A58554A'
Image|endswith: '\wmic.exe'
OriginalFileName: wmic.exe
Stage 2: all of selection_cli
or:
CommandLine|contains: '://'
CommandLine|contains: '\\\\'
CommandLine|contains: '/format:'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
Hashes | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|