Detectionhightest

WMImplant Hack Tool

Detects parameters used by WMImplant

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

NVISOCreated Thu Mar 26Updated Sun Dec 258028c2c3-e25a-46e3-827f-bbb5abf181d7windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        ScriptBlockText|contains:
            - 'WMImplant'
            - ' change_user '
            - ' gen_cli '
            - ' command_exec '
            - ' disable_wdigest '
            - ' disable_winrm '
            - ' enable_wdigest '
            - ' enable_winrm '
            - ' registry_mod '
            - ' remote_posh '
            - ' sched_job '
            - ' service_mod '
            - ' process_kill '
            # - ' process_start '
            - ' active_users '
            - ' basic_info '
            # - ' drive_list '
            # - ' installed_programs '
            - ' power_off '
            - ' vacant_system '
            - ' logon_events '
    condition: selection