Title:
WMIC Loading Scripting Libraries
Status:
test
Description:Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.
References:
-https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
-https://twitter.com/dez_/status/986614411711442944
-https://lolbas-project.github.io/lolbas/Binaries/Wmic/
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-17
modified:2022-10-13
Tags:
- -'attack.stealth'
- -'attack.t1220'
Logsource:
- category: image_load
- product: windows
Detection:
selection:
Image|endswith:
'\wmic.exe'
ImageLoaded|endswith:
-'\jscript.dll'
-'\vbscript.dll'
condition:
selection
Falsepositives:
-The command wmic os get lastbootuptime loads vbscript.dll
-The command wmic os get locale loads vbscript.dll
-Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
-The command `wmic ntevent` loads vbscript.dll
Level:
medium
