Crowdstrike WMI Query Detection

Description

Detects execution of WMI queries involving information gathering or actions on remote systems, which could indicate reconnaissance or lateral movement.

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

WMIC_SIGNATURES = ["get", "list", "process call create", "cmd.exe", "powershell.exe", "command.exe"]


def rule(event):
    if event.deep_get("event", "event_simpleName") == "ProcessRollup2":
        if event.deep_get("event", "event_platform") == "Win":
            if event.deep_get("event", "ImageFileName", default="").split("\\")[-1] == "wmic.exe":
                command_line = event.deep_get("event", "CommandLine", default="")
                for signature in WMIC_SIGNATURES:
                    if signature in command_line:
                        return True
    return False


def title(event):
    cmd = event.deep_get("event", "CommandLine", default="<COMMAND_LINE_NOT_FOUND>")
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: WMIC Query [{cmd}] performed on host [{host}]"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)

Analyst notes

Investigate the endpoint for signs of WMI query execution. Review the executed query and the associated user account.

Raw source Crowdstrike WMI Query Detection · Panther Python
Esc
Published by panther-labs/panther-analysis ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
AnalysisType: rule
Description: Detects execution of WMI queries involving information gathering or actions on remote systems, which could indicate reconnaissance or lateral movement.
DisplayName: "Crowdstrike WMI Query Detection"
Enabled: true
Filename: crowdstrike_wmi_query_detection.py
Runbook: Investigate the endpoint for signs of WMI query execution. Review the executed query and the associated user account.
Reference: https://learn.microsoft.com/en-us/windows/win32/wmisdk/querying-wmi
Severity: Low
Tests:
  - ExpectedResult: false
    Log:
      aid: 1234567890abcdefg654321
      aip: 11.10.9.8
      cid: abcdefghijklmnop123467890
      configbuild: 1007.3.0016606.11
      configstatehash: "3799024366"
      entitlements: "15"
      event:
        AuthenticationId: "293628"
        AuthenticodeHashData: 5540c470218d209b7c3eca3d12e190580814d566
        CommandLine: C:\Windows\System32\wmic.exe nothing
        ConfigBuild: 1007.3.0016606.11
        ConfigStateHash: "3799024366"
        EffectiveTransmissionClass: "2"
        Entitlements: "15"
        ImageFileName: \Device\HarddiskVolume2\Windows\System32\wmic.exe
        ImageSubsystem: "3"
        IntegrityLevel: "12288"
        MD5HashData: 5fd22b915c232378e567160d641cc9f2
        ParentAuthenticationId: "293628"
        ParentBaseFileName: pwsh.exe
        ParentProcessId: "4370948876"
        ProcessCreateFlags: "0"
        ProcessEndTime: ""
        ProcessParameterFlags: "24577"
        ProcessStartTime: "1682106752.006"
        ProcessSxsFlags: "64"
        RawProcessId: "1468"
        SHA1HashData: "0000000000000000000000000000000000000000"
        SHA256HashData: 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
        SessionId: "2"
        SignInfoFlags: "8683538"
        SourceProcessId: "4370948876"
        SourceThreadId: "6364981533"
        Tags: 25, 27, 40, 151, 874, 924, 12094627905582, 12094627906234, 237494511599633
        TargetProcessId: "4390327988"
        TokenType: "1"
        TreeId: "4295752857"
        UserSid: S-1-5-21-239183934-720705223-383019856-500
        aid: 1234567890abcdefg654321
        aip: 11.10.9.8
        cid: abcdefghijklmnop123467890
        event_platform: Win
        event_simpleName: ProcessRollup2
        id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
        name: ProcessRollup2V19
        timestamp: "1682106752722"
      event_platform: Win
      event_simplename: ProcessRollup2
      fdr_event_type: ProcessRollup2
      id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
      name: ProcessRollup2V19
      p_any_ip_addresses:
        - 11.10.9.8
      p_any_md5_hashes:
        - 5fd22b915c232378e567160d641cc9f2
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_any_sha1_hashes:
        - "0000000000000000000000000000000000000000"
      p_any_sha256_hashes:
        - 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
      p_any_trace_ids:
        - "4295752857"
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_event_time: "2023-04-21 19:52:32.722"
      p_log_type: Crowdstrike.FDREvent
      p_parse_time: "2023-04-21 20:05:52.94"
      p_row_id: 7ac82dbb43a99bfec196bdda178c8101
      p_schema_version: 0
      p_source_id: 1f33f64c-124d-413c-a9e3-d51ccedd8e77
      p_source_label: Crowdstrike-FDR-Dev
      timestamp: "2023-04-21 19:52:32.722"
      treeid: "4295752857"
    Name: Benign wmic
  - ExpectedResult: false
    Log:
      aid: 1234567890abcdefg654321
      aip: 11.10.9.8
      cid: abcdefghijklmnop123467890
      configbuild: 1007.3.0016606.11
      configstatehash: "3799024366"
      entitlements: "15"
      event:
        AuthenticationId: "293628"
        AuthenticodeHashData: 5540c470218d209b7c3eca3d12e190580814d566
        CommandLine: C:\Windows\System32\nc.exe -n 1.1.1.1 80
        ConfigBuild: 1007.3.0016606.11
        ConfigStateHash: "3799024366"
        EffectiveTransmissionClass: "2"
        Entitlements: "15"
        ImageFileName: \Device\HarddiskVolume2\Windows\System32\nc.exe
        ImageSubsystem: "3"
        IntegrityLevel: "12288"
        MD5HashData: 5fd22b915c232378e567160d641cc9f2
        ParentAuthenticationId: "293628"
        ParentBaseFileName: pwsh.exe
        ParentProcessId: "4370948876"
        ProcessCreateFlags: "0"
        ProcessEndTime: ""
        ProcessParameterFlags: "24577"
        ProcessStartTime: "1682106752.006"
        ProcessSxsFlags: "64"
        RawProcessId: "1468"
        SHA1HashData: "0000000000000000000000000000000000000000"
        SHA256HashData: 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
        SessionId: "2"
        SignInfoFlags: "8683538"
        SourceProcessId: "4370948876"
        SourceThreadId: "6364981533"
        Tags: 25, 27, 40, 151, 874, 924, 12094627905582, 12094627906234, 237494511599633
        TargetProcessId: "4390327988"
        TokenType: "1"
        TreeId: "4295752857"
        UserSid: S-1-5-21-239183934-720705223-383019856-500
        aid: 1234567890abcdefg654321
        aip: 11.10.9.8
        cid: abcdefghijklmnop123467890
        event_platform: Win
        event_simpleName: ProcessRollup2
        id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
        name: ProcessRollup2V19
        timestamp: "1682106752722"
      event_platform: Win
      event_simplename: ProcessRollup2
      fdr_event_type: ProcessRollup2
      id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
      name: ProcessRollup2V19
      p_any_ip_addresses:
        - 11.10.9.8
      p_any_md5_hashes:
        - 5fd22b915c232378e567160d641cc9f2
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_any_sha1_hashes:
        - "0000000000000000000000000000000000000000"
      p_any_sha256_hashes:
        - 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
      p_any_trace_ids:
        - "4295752857"
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_event_time: "2023-04-21 19:52:32.722"
      p_log_type: Crowdstrike.FDREvent
      p_parse_time: "2023-04-21 20:05:52.94"
      p_row_id: 7ac82dbb43a99bfec196bdda178c8101
      p_schema_version: 0
      p_source_id: 1f33f64c-124d-413c-a9e3-d51ccedd8e77
      p_source_label: Crowdstrike-FDR-Dev
      timestamp: "2023-04-21 19:52:32.722"
      treeid: "4295752857"
    Name: Other
  - ExpectedResult: true
    Log:
      aid: 1234567890abcdefg654321
      aip: 11.10.9.8
      cid: abcdefghijklmnop123467890
      configbuild: 1007.3.0016606.11
      configstatehash: "3799024366"
      entitlements: "15"
      event:
        AuthenticationId: "293628"
        AuthenticodeHashData: 5540c470218d209b7c3eca3d12e190580814d566
        CommandLine: C:\Windows\System32\wmic.exe useraccount get name,password
        ConfigBuild: 1007.3.0016606.11
        ConfigStateHash: "3799024366"
        EffectiveTransmissionClass: "2"
        Entitlements: "15"
        ImageFileName: \Device\HarddiskVolume2\Windows\System32\wmic.exe
        ImageSubsystem: "3"
        IntegrityLevel: "12288"
        MD5HashData: 5fd22b915c232378e567160d641cc9f2
        ParentAuthenticationId: "293628"
        ParentBaseFileName: pwsh.exe
        ParentProcessId: "4370948876"
        ProcessCreateFlags: "0"
        ProcessEndTime: ""
        ProcessParameterFlags: "24577"
        ProcessStartTime: "1682106752.006"
        ProcessSxsFlags: "64"
        RawProcessId: "1468"
        SHA1HashData: "0000000000000000000000000000000000000000"
        SHA256HashData: 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
        SessionId: "2"
        SignInfoFlags: "8683538"
        SourceProcessId: "4370948876"
        SourceThreadId: "6364981533"
        Tags: 25, 27, 40, 151, 874, 924, 12094627905582, 12094627906234, 237494511599633
        TargetProcessId: "4390327988"
        TokenType: "1"
        TreeId: "4295752857"
        UserSid: S-1-5-21-239183934-720705223-383019856-500
        aid: 1234567890abcdefg654321
        aip: 11.10.9.8
        cid: abcdefghijklmnop123467890
        event_platform: Win
        event_simpleName: ProcessRollup2
        id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
        name: ProcessRollup2V19
        timestamp: "1682106752722"
      event_platform: Win
      event_simplename: ProcessRollup2
      fdr_event_type: ProcessRollup2
      id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
      name: ProcessRollup2V19
      p_any_ip_addresses:
        - 11.10.9.8
      p_any_md5_hashes:
        - 5fd22b915c232378e567160d641cc9f2
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_any_sha1_hashes:
        - "0000000000000000000000000000000000000000"
      p_any_sha256_hashes:
        - 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
      p_any_trace_ids:
        - "4295752857"
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_event_time: "2023-04-21 19:52:32.722"
      p_log_type: Crowdstrike.FDREvent
      p_parse_time: "2023-04-21 20:05:52.94"
      p_row_id: 7ac82dbb43a99bfec196bdda178c8101
      p_schema_version: 0
      p_source_id: 1f33f64c-124d-413c-a9e3-d51ccedd8e77
      p_source_label: Crowdstrike-FDR-Dev
      timestamp: "2023-04-21 19:52:32.722"
      treeid: "4295752857"
    Name: wmic get name password
  - ExpectedResult: true
    Log:
      aid: 1234567890abcdefg654321
      aip: 11.10.9.8
      cid: abcdefghijklmnop123467890
      configbuild: 1007.3.0016606.11
      configstatehash: "3799024366"
      entitlements: "15"
      event:
        AuthenticationId: "293628"
        AuthenticodeHashData: 5540c470218d209b7c3eca3d12e190580814d566
        CommandLine: C:\Windows\System32\wmic.exe process call create "cmd.exe /c malware.exe"
        ConfigBuild: 1007.3.0016606.11
        ConfigStateHash: "3799024366"
        EffectiveTransmissionClass: "2"
        Entitlements: "15"
        ImageFileName: \Device\HarddiskVolume2\Windows\System32\wmic.exe
        ImageSubsystem: "3"
        IntegrityLevel: "12288"
        MD5HashData: 5fd22b915c232378e567160d641cc9f2
        ParentAuthenticationId: "293628"
        ParentBaseFileName: pwsh.exe
        ParentProcessId: "4370948876"
        ProcessCreateFlags: "0"
        ProcessEndTime: ""
        ProcessParameterFlags: "24577"
        ProcessStartTime: "1682106752.006"
        ProcessSxsFlags: "64"
        RawProcessId: "1468"
        SHA1HashData: "0000000000000000000000000000000000000000"
        SHA256HashData: 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
        SessionId: "2"
        SignInfoFlags: "8683538"
        SourceProcessId: "4370948876"
        SourceThreadId: "6364981533"
        Tags: 25, 27, 40, 151, 874, 924, 12094627905582, 12094627906234, 237494511599633
        TargetProcessId: "4390327988"
        TokenType: "1"
        TreeId: "4295752857"
        UserSid: S-1-5-21-239183934-720705223-383019856-500
        aid: 1234567890abcdefg654321
        aip: 11.10.9.8
        cid: abcdefghijklmnop123467890
        event_platform: Win
        event_simpleName: ProcessRollup2
        id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
        name: ProcessRollup2V19
        timestamp: "1682106752722"
      event_platform: Win
      event_simplename: ProcessRollup2
      fdr_event_type: ProcessRollup2
      id: 081d64d7-17fb-40c0-8767-48ff1e2ee2dd
      name: ProcessRollup2V19
      p_any_ip_addresses:
        - 11.10.9.8
      p_any_md5_hashes:
        - 5fd22b915c232378e567160d641cc9f2
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_any_sha1_hashes:
        - "0000000000000000000000000000000000000000"
      p_any_sha256_hashes:
        - 488e74e2026d03f21b33f470c23b3de2f466643186c2e06ae7b4883cc2e59377
      p_any_trace_ids:
        - "4295752857"
        - 1234567890abcdefg654321
        - abcdefghijklmnop123467890
      p_event_time: "2023-04-21 19:52:32.722"
      p_log_type: Crowdstrike.FDREvent
      p_parse_time: "2023-04-21 20:05:52.94"
      p_row_id: 7ac82dbb43a99bfec196bdda178c8101
      p_schema_version: 0
      p_source_id: 1f33f64c-124d-413c-a9e3-d51ccedd8e77
      p_source_label: Crowdstrike-FDR-Dev
      timestamp: "2023-04-21 19:52:32.722"
      treeid: "4295752857"
    Name: wmic process create
DedupPeriodMinutes: 60
LogTypes:
  - Crowdstrike.FDREvent
RuleID: "Crowdstrike.WMI.Query.Detection"
Threshold: 1


# ------ paired body: crowdstrike_wmi_query_detection.py ------

from panther_crowdstrike_fdr_helpers import crowdstrike_detection_alert_context

WMIC_SIGNATURES = ["get", "list", "process call create", "cmd.exe", "powershell.exe", "command.exe"]


def rule(event):
    if event.deep_get("event", "event_simpleName") == "ProcessRollup2":
        if event.deep_get("event", "event_platform") == "Win":
            if event.deep_get("event", "ImageFileName", default="").split("\\")[-1] == "wmic.exe":
                command_line = event.deep_get("event", "CommandLine", default="")
                for signature in WMIC_SIGNATURES:
                    if signature in command_line:
                        return True
    return False


def title(event):
    cmd = event.deep_get("event", "CommandLine", default="<COMMAND_LINE_NOT_FOUND>")
    host = event.get("ComputerName") or event.get("aid", "<AID_NOT_FOUND>")
    return f"Crowdstrike: WMIC Query [{cmd}] performed on host [{host}]"


def alert_context(event):
    return crowdstrike_detection_alert_context(event)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.