Wmic (24f3b066-a533-4b6c-a590-313a67154ba0)
This object contains information sourced from the Living Off The Land Binaries, Scripts and Libraries (LOLBAS) project, which is licensed under GNU General Public License v3.0.
Description: The WMI command-line (WMIC) utility provides a command-line interface for WMI
Author: Oddvar Moe
Paths: * C:\Windows\System32\wbem\wmic.exe * C:\Windows\SysWOW64\wbem\wmic.exe
Resources: * https://stackoverflow.com/questions/24658745/wmic-how-to-use-process-call-create-with-a-specific-working-directory * https://subt0x11.blogspot.no/2018/04/wmicexe-whitelisting-bypass-hacking.html * https://twitter.com/subTee/status/986234811944648707
Detection: * Sigma: image_load_wmic_remote_xsl_scripting_dlls.yml * Sigma: proc_creation_win_wmic_xsl_script_processing.yml * Sigma: proc_creation_win_wmic_squiblytwo_bypass.yml * Sigma: proc_creation_win_wmic_eventconsumer_creation.yml * Elastic: defense_evasion_suspicious_wmi_script.toml * Elastic: persistence_via_windows_management_instrumentation_event_subscription.toml * Elastic: defense_evasion_suspicious_managedcode_host_process.toml * Splunk: xsl_script_execution_with_wmic.yml * Splunk: remote_wmi_command_attempt.yml * Splunk: remote_process_instantiation_via_wmi.yml * Splunk: process_execution_via_wmi.yml * BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules * IOC: Wmic retrieving scripts from remote system/Internet location * IOC: DotNet CLR libraries loaded into wmic.exe * IOC: DotNet CLR Usage Log - wmic.exe.log[LOLBAS Wmic]