Potential Unquoted Service Path Reconnaissance Via Wmic.EXE

Title: Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
Status: test
Description:Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts
References:
  -https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
  -https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
  -https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
modified:2023-09-11
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
OriginalFileName:'wmic.exe' Image|endswith:'\WMIC.exe'   selection_cli:
    CommandLine|contains|all:
      -' service get '
      -'name,displayname,pathname,startmode'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium