Wmiexec Default Output File

Title: Wmiexec Default Output File
Status: test
Description:Detects the creation of the default output filename used by the wmiexec tool
References:
  -https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
  -https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-02
modified:2023-03-08
Tags:

• -'attack.lateral-movement'
• -'attack.execution'
• -'attack.t1047'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
TargetFilename|re:'\\Windows\\__1\d{9}\.\d{1,7}$' TargetFilename|re:'C:\\__1\d{9}\.\d{1,7}$' TargetFilename|re:'D:\\__1\d{9}\.\d{1,7}$'   condition:selection
Falsepositives:
  -Unlikely
Level: critical