WMIC Remote Command Execution

Title: WMIC Remote Command Execution
Status: test
Description:Detects the execution of WMIC to query information on a remote system
References:
  -https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-14
modified:2025-10-22
Tags:

• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\WMIC.exe' OriginalFileName:'wmic.exe'   selection_cli:
    CommandLine|contains|windash: '/node:'
  filter_main_localhost:
    CommandLine|contains:
      -'localhost'
      -'127.0.0.1'

  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium