detect-office-products-spawning-wmic

Description

This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain management data and perform administrative tasks on remote devices. However, attackers can also use WMI to gather information about a target or hijack control of a device. The MITRE ATT&CK framework includes WMI among its list of common enterprise attack techniques. The following query detects when Microsoft Office software spawns an instance of the WMI command-line utility, wmic.exe. References: https://docs.microsoft.com/windows/win32/wmisdk/about-wmi https://attack.mitre.org/techniques/T1047/

Query · kql

// Office products spawning WMI
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe")
and FileName =~"wmic.exe"
Raw source detect-office-products-spawning-wmic · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 2c0a068e-b30c-4e6a-928c-f05b60c43066
name: detect-office-products-spawning-wmic
description: |
  This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
  Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain management data and perform administrative tasks on remote devices. However, attackers can also use WMI to gather information about a target or hijack control of a device. The MITRE ATT&CK framework includes WMI among its list of common enterprise attack techniques.
  The following query detects when Microsoft Office software spawns an instance of the WMI command-line utility, wmic.exe.
  References:
  https://docs.microsoft.com/windows/win32/wmisdk/about-wmi
  https://attack.mitre.org/techniques/T1047/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  // Office products spawning WMI
  DeviceProcessEvents
  | where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe")
  and FileName =~"wmic.exe"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.