PSExec and WMI Process Creations Block

Title: PSExec and WMI Process Creations Block
Status: test
Description:Detects blocking of process creations originating from PSExec and WMI commands
References:
  -https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
  -https://twitter.com/duff22b/status/1280166329660497920
Author: Bhabesh Raj
Date: 2020-07-14
modified:2022-12-25
Tags:

• -'attack.execution'
• -'attack.lateral-movement'
• -'attack.t1047'
• -'attack.t1569.002'

Logsource:

• product: windows
• service: windefend
• definition: Requirements:Enabled Block process creations originating from PSExec and WMI commands from Attack Surface Reduction (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)

Detection:
  selection:
    EventID: '1121'
    ProcessName|endswith:
      -'\wmiprvse.exe'
      -'\psexesvc.exe'

  condition:selection
Falsepositives:
  -Unknown
Level: high