WMImplant Hack Tool

Title: WMImplant Hack Tool
Status: test
Description:Detects parameters used by WMImplant
References:
  -https://github.com/FortyNorthSecurity/WMImplant
Author: NVISO
Date: 2020-03-26
modified:2022-12-25
Tags:

• -'attack.execution'
• -'attack.t1047'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'WMImplant'
      -' change_user '
      -' gen_cli '
      -' command_exec '
      -' disable_wdigest '
      -' disable_winrm '
      -' enable_wdigest '
      -' enable_winrm '
      -' registry_mod '
      -' remote_posh '
      -' sched_job '
      -' service_mod '
      -' process_kill '
      -' active_users '
      -' basic_info '
      -' power_off '
      -' vacant_system '
      -' logon_events '

  condition:selection
Falsepositives:
  -Administrative scripts that use the same keywords.
Level: high