WMIC Unquoted Services Path Lookup - PowerShell

Title: WMIC Unquoted Services Path Lookup - PowerShell
Status: test
Description:Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts
References:
  -https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
  -https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
  -https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
modified:2022-11-25
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'Get-WmiObject '
      -'gwmi '

    ScriptBlockText|contains|all:
      -' Win32_Service '
      -'Name'
      -'DisplayName'
      -'PathName'
      -'StartMode'

  condition:selection
Falsepositives:
  -Unknown
Level: medium