Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionmediumtest

New Process Created Via Wmic.EXE

Detects new process creation using WMIC via the "process call create" flag

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.communityCreated Wed Jan 16Updated Tue Feb 14526be59f-a573-4eea-b5f7-f0973207634dwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic2 selectors
detection:
    selection_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'process'
            - 'call'
            - 'create'
    condition: all of selection_*
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
sans.org
2
Resolving title…
github.com
MITRE ATT&CK

CAR Analytics

2016-03-002 · CAR 2016-03-002
Related Rules
DerivedDetectionhigh

Suspicious Process Created Via Wmic.EXE

Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata
Rule ID
526be59f-a573-4eea-b5f7-f0973207634d
Status
test
Level
medium
Type
Detection
Created
Wed Jan 16
Modified
Tue Feb 14
Author
Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
Path
rules/windows/process_creation/proc_creation_win_wmic_process_creation.yml
Raw Tags
attack.executionattack.t1047car.2016-03-002
View on GitHub