Process Creation Attempt via Wmic.EXE

Title: Process Creation Attempt via Wmic.EXE
Status: test
Description:Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful.
References:
  -https://www.sans.org/blog/wmic-for-incident-response/
  -https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process
Author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
Date: 2019-01-16
modified:2023-02-14
Tags:

• -'attack.execution'
• -'attack.t1047'
• -'car.2016-03-002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\wmic.exe' OriginalFileName:'wmic.exe'   selection_cli:
    CommandLine|contains|all:
      -'process'
      -'call'
      -'create'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium