Detectioncriticaltest

Wmiexec Default Output File

Detects the creation of the default output filename used by the wmiexec tool

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Thu Jun 02Updated Wed Mar 088d5aca11-22b3-4f22-b7ba-90e60533e1fbwindows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        - TargetFilename|re: '\\Windows\\__1\d{9}\.\d{1,7}$' # Admin$
        - TargetFilename|re: 'C:\\__1\d{9}\.\d{1,7}$' # C$
        - TargetFilename|re: 'D:\\__1\d{9}\.\d{1,7}$' # D$
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0008 · Lateral Movement TA0002 · Execution

Techniques

T1047 · Windows Management Instrumentation

Rule Metadata

Rule ID

8d5aca11-22b3-4f22-b7ba-90e60533e1fb

Status

test

Level

critical

Type

Detection

Created

Thu Jun 02

Modified

Wed Mar 08

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml

Raw Tags

attack.lateral-movementattack.executionattack.t1047

View on GitHub