DLLHost.exe WMIC domain discovery

Description

Identify dllhost.exe using WMIC to discover additional hosts and associated domain.

Query · kql

DeviceProcessEvents 
| where InitiatingProcessFileName =~ "dllhost.exe" and InitiatingProcessCommandLine == "dllhost.exe" 
| where ProcessCommandLine has "wmic computersystem get domain"
Raw source DLLHost.exe WMIC domain discovery · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: dc612ff9-88ac-4968-97c1-6789cd48c5d8
name: DLLHost.exe WMIC domain discovery
description: |
  Identify dllhost.exe using WMIC to discover additional hosts and associated domain.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Reconnaissance
query: |   
  DeviceProcessEvents 
  | where InitiatingProcessFileName =~ "dllhost.exe" and InitiatingProcessCommandLine == "dllhost.exe" 
  | where ProcessCommandLine has "wmic computersystem get domain"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.