Windows WMI Impersonate Token

Name:Windows WMI Impersonate Token
id:cf192860-2d94-40db-9a51-c04a2e8a8f8b
version:11
date:None
author:Teoderick Contreras, Splunk
status:production
type:Anomaly
Description:The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access. It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff).
Data_source:

• -Sysmon EventID 10

search:`sysmon`
EventCode=10
SourceImage="*\\wmiprvse.exe"

```
The 0x1478 mask combines query, VM, and duplicate-handle rights;
The 0x1fffff mas is full process access.
Additional requested rights are allowed.
```
| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
| eval PROCESS_QUERY_INFORMATION = 1024
| eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
| eval PROCESS_VM_OPERATION = 8
| eval PROCESS_VM_READ = 16
| eval PROCESS_VM_WRITE = 32
| eval PROCESS_DUP_HANDLE = 64
| eval WMI_REQUIRED_ACCESS = PROCESS_QUERY_INFORMATION + PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_OPERATION + PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_DUP_HANDLE
| eval PROCESS_ALL_ACCESS = 2097151
| eval wmi_access_set = bit_and(g_access_decimal, WMI_REQUIRED_ACCESS)
| eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS)
| where wmi_access_set == WMI_REQUIRED_ACCESS
OR full_access_set == PROCESS_ALL_ACCESS

| stats count min(_time) as firstTime
max(_time) as lastTime
BY user_id dest
signature_id signature granted_access Opcode
SourceImage SourceProcessGUID SourceProcessId
TargetImage TargetProcessGUID TargetProcessId
CallTrace vendor_product

| eval CallTrace=split(CallTrace, "|")

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_wmi_impersonate_token_filter`

how_to_implement:This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives:administrator may execute impersonate wmi object script for auditing. Filter is needed.
References:
  -https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md
  -https://www.joesandbox.com/analysis/278341/0/html
drilldown_searches:
 name:'View the detection results for - "$dest$"'
 search:'%original_detection_search% | search dest = "$dest$"'
 earliest_offset:'$info_min_time$'
 latest_offset:'$info_max_time$'
 name:'View risk events for the last 7 days for - "$dest$"'
 search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
 earliest_offset:'7d'
 latest_offset:'0'
analytic_story:['Qakbot', 'Water Gamayun']

asset_type:Endpoint

mitre_attack_id:['T1047']

product:['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud']

category:endpoint

security_domain:endpoint

tags:

tests:
 name:'True Positive Test'
 attack_data:
  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log
  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  sourcetype: XmlWinEventLog
 test_type:'unit'
manual_test:None