detect-impacket-wmiexec

Hunt Hypothesis

Adversaries may use the impacket wmiexec module to execute commands remotely on Windows systems, leveraging WMI for persistence and lateral movement. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromise and mitigate advanced threats that evade traditional detection methods.

KQL Query

let LookupTime = 30d;
 let GetRareWMIProcessLaunches = materialize (
 DeviceEvents
 | where Timestamp > ago(LookupTime)
 | where ActionType == @"ProcessCreatedUsingWmiQuery"
 | where isnotempty(FileName)
 | summarize count() by SHA1, InitiatingProcessCommandLine
 | where count_ < 5 | distinct SHA1); 
 DeviceEvents 
 | where Timestamp > ago(LookupTime)
 | where ActionType == @"ProcessCreatedUsingWmiQuery"
 | where SHA1 in~ (GetRareWMIProcessLaunches)
 | where isnotempty(FileName)
 | project DeviceName, WMIProcessLaunchTimestmap = Timestamp, ProcessLaunchedByWMI = tolower(FileName), ProcessLaunchedByWMICommandLine = tolower(ProcessCommandLine), ProcessLaunchedByWMICreationTime = ProcessCreationTime, ProcessLaunchedByWMISHA1 = tolower(SHA1), ProcessLaunchedByWMIID = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentCreationTime, InitiatingProcessParentFileName
 | join kind=leftouter (
 DeviceProcessEvents
 | where Timestamp > ago(LookupTime)
 | where InitiatingProcessSHA1 in~ (GetRareWMIProcessLaunches)
 |project DeviceName, ChildProcessTimestamp = Timestamp, ProcessLaunchedByWMI = tolower(InitiatingProcessFileName), ProcessLaunchedByWMICommandLine = tolower(InitiatingProcessCommandLine), ProcessLaunchedByWMICreationTime = InitiatingProcessCreationTime, ProcessLaunchedByWMISHA1 = tolower(InitiatingProcessSHA1), ProcessLaunchedByWMIID = InitiatingProcessId, WMIchild = FileName, WMIChildCommandline = ProcessCommandLine
 ) on DeviceName, ProcessLaunchedByWMI, ProcessLaunchedByWMICommandLine, ProcessLaunchedByWMISHA1, ProcessLaunchedByWMIID
 | join kind=leftouter (
 DeviceNetworkEvents
 | where Timestamp > ago(LookupTime)
 | where InitiatingProcessSHA1 in~ (GetRareWMIProcessLaunches)
 |project DeviceName, ChildProcessTimestamp = Timestamp, ProcessLaunchedByWMI = tolower(InitiatingProcessFileName), ProcessLaunchedByWMICommandLine = tolower(InitiatingProcessCommandLine), ProcessLaunchedByWMICreationTime = InitiatingProcessCreationTime, ProcessLaunchedByWMISHA1 = tolower(InitiatingProcessSHA1), ProcessLaunchedByWMIID = InitiatingProcessId, WMIProcessRemoteIP = RemoteIP, WMIProcessRemoteURL = RemoteUrl
 ) on DeviceName, ProcessLaunchedByWMI, ProcessLaunchedByWMICommandLine, ProcessLaunchedByWMISHA1, ProcessLaunchedByWMIID
 | where isnotempty(WMIProcessRemoteIP) or isnotempty(WMIchild)
 | summarize ConnectedAddresses = make_set(WMIProcessRemoteIP), ConnectedURLs = make_set(WMIProcessRemoteURL), LaunchedProcessNames = make_set(WMIchild), LaunchedProcessCmdlines = make_set(WMIChildCommandline) by DeviceName, ProcessLaunchedByWMI, ProcessLaunchedByWMICommandLine, ProcessLaunchedByWMICreationTime, ProcessLaunchedByWMISHA1, ProcessLaunchedByWMIID

Analytic Rule Definition

id: e5c65f1f-2bf8-4b42-af8b-1f6adfeda0cc
name: detect-impacket-wmiexec
description: |
  This query looks for signs of impacket wmiexec module usage. May hit other wmi execution-like techniques too.
  Author: Jouni Mikkola
  More info: https://threathunt.blog/impacket-part-2/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
  - DeviceNetworkEvents
  - DeviceProcessEvents
tactics:
- Execution
relevantTechniques:
  - T1047
query: |
 let LookupTime = 30d;
  let GetRareWMIProcessLaunches = materialize (
  DeviceEvents
  | where Timestamp > ago(LookupTime)
  | where ActionType == @"ProcessCreatedUsingWmiQuery"
  | where isnotempty(FileName)
  | summarize count() by SHA1, InitiatingProcessCommandLine
  | where count_ < 5 | distinct SHA1); 
  DeviceEvents 
  | where Timestamp > ago(LookupTime)
  | where ActionType == @"ProcessCreatedUsingWmiQuery"
  | where SHA1 in~ (GetRareWMIProcessLaunches)
  | where isnotempty(FileName)
  | project DeviceName, WMIProcessLaunchTimestmap = Timestamp, ProcessLaunchedByWMI = tolower(FileName), ProcessLaunchedByWMICommandLine = tolower(ProcessCommandLine), ProcessLaunchedByWMICreationTime = ProcessCreationTime, ProcessLaunchedByWMISHA1 = tolower(SHA1), ProcessLaunchedByWMIID = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentCreationTime, InitiatingProcessParentFileName
  | join kind=leftouter (
  DeviceProcessEvents
  | where Timestamp > ago(LookupTime)
  | where InitiatingProcessSHA1 in~ (GetRareWMIProcessLaunches)
  |project DeviceName, ChildProcessTimestamp = Timestamp, ProcessLaunchedByWMI = tolower(InitiatingProcessFileName), ProcessLaunchedByWMICommandLine = tolower(InitiatingProcessCommandLine), ProcessLaunchedByWMICreationTime = InitiatingProcessCreationTime, ProcessLaunchedByWMISHA1 = tolower(InitiatingProcessSHA1), ProcessLaunchedByWMIID = InitiatingProcessId, WMIchild = FileName, WMIChildCommandline = ProcessCommandLine
  ) on DeviceName, ProcessLaunchedByWMI, ProcessLaunchedByWMICommandLine, ProcessLaunchedByWMISHA1, ProcessLaunchedByWMIID
  | join kind=leftouter (
  DeviceNetworkEvents
  | where Timestamp > ago(LookupTime)
  | where InitiatingProcessSHA1 in~ (GetRareWMIProcessLaunches)
  |project DeviceName, ChildProcessTimestamp = Timestamp, ProcessLaunchedByWMI = tolower(InitiatingProcessFileName), ProcessLaunchedByWMICommandLine = tolower(InitiatingProcessCommandLine), ProcessLaunchedByWMICreationTime = InitiatingProcessCreationTime, ProcessLaunchedByWMISHA1 = tolower(InitiatingProcessSHA1), ProcessLaunchedByWMIID = InitiatingProcessId, WMIProcessRemoteIP = RemoteIP, WMIProcessRemoteURL = RemoteUrl
  ) on DeviceName, ProcessLaunchedByWMI, ProcessLaunchedByWMICommandLine, ProcessLaunchedByWMISHA1, ProcessLaunchedByWMIID
  | where isnotempty(WMIProcessRemoteIP) or isnotempty(WMIchild)
  | summarize ConnectedAddresses = make_set(WMIProcessRemoteIP), ConnectedURLs = make_set(WMIProcessRemoteURL), LaunchedProcessNames = mak

Required Data Sources

MITRE ATT&CK Context

• Tactic: Execution
• Technique: T1047 — T1047

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Execution/detect-impacket-wmiexec.yaml)

False Positive Guidance

• Scenario: Legitimate WMI Execution for System Monitoring
  Description: A system administrator uses wmic to monitor system performance or check for hardware status.
  Filter/Exclusion: Check for wmic commands related to cpu, memory, or disk usage, or filter by known admin tools like WMIC or PowerShell with Get-WmiObject.

• Scenario: Scheduled Job for Patch Management
  Description: A scheduled task runs a script using wmiexec to apply patches or updates across the network.
  Filter/Exclusion: Filter by schtasks.exe or Task Scheduler context, and check for known patch management tools like Windows Update or SCCM.

• Scenario: Remote Administration Using WMI
  Description: A sysadmin uses wmiexec to remotely reboot or restart services on multiple machines.
  Filter/Exclusion: Filter by reboot or service commands, and check for known administrative tools like PsExec or WinRM.

• Scenario: PowerShell Remoting with WMI
  Description: A script uses PowerShell remoting (Invoke-Command) to execute WMI commands across the network.
  Filter/Exclusion: Filter by powershell.exe with Invoke-Command or Enter-PSSession, and check for known PowerShell remoting modules.

• Scenario: Legacy Application Using WMI for Communication
  Description: A legacy enterprise application uses WMI for internal communication or data retrieval between systems.
  Filter/Exclusion: Filter by known application names or service accounts, and check for specific WMI class names or methods used by the application.