WMI Tool - APT

Hunt Hypothesis

This detection rule identifies adversaries leveraging Windows Management Instrumentation (WMI) to execute commands and establish persistence, a tactic frequently employed by Advanced Persistent Threats (APTs) for stealthy lateral movement within Azure environments. Proactively hunting for this behavior in Azure Sentinel is critical because WMI operations often bypass traditional file-based monitoring, allowing attackers to operate undetected while accessing sensitive resources across the cloud infrastructure.

YARA Rule

rule WMI_vbs : APT
{
    meta:
        description = "WMI Tool - APT"
        author = "Florian Roth"
        release_date = "2013-11-29"
        confidential = false
		score = 70
    strings:
		$s3 = "WScript.Echo \"   $$\\      $$\\ $$\\      $$\\ $$$$$$\\ $$$$$$$$\\ $$\\   $$\\ $$$$$$$$\\  $$$$$$"
    condition:
        all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the WMI Tool - APT detection rule, including suggested filters and exclusions:

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Software Updates

  • Context: The SCCM client service (ccmexec.exe) frequently utilizes WMI to query hardware inventory or push software updates across the enterprise network. This often triggers high-volume WMI event logs that mimic APT lateral movement behavior.
  • Suggested Filter/Exclusion: Exclude events where the ProcessName is ccmexec.exe and the CommandLine contains keywords like “SoftwareUpdates” or “Inventory”. Alternatively, filter out WMI queries originating from the SCCM site server IP range during known maintenance windows (e.g., 02:00–04:00).

• Scenario: Scheduled PowerShell Health Checks via Task Scheduler

  • Context: IT operations often deploy scheduled tasks using powershell.exe to run health checks or compliance audits. These scripts frequently invoke WMI (Get-WmiObject) to gather system metrics, which can be flagged as suspicious APT activity due to the use of PowerShell in conjunction with WMI.
  • Suggested Filter/Exclusion: Create an exclusion for events where the ParentProcessName is svchost.exe (specifically the Schedule service) and the CommandLine matches a known hash or path pattern for internal audit scripts (e.g., C:\Scripts\HealthCheck.ps1).

• Scenario: Microsoft Defender Antivirus Real-Time Scanning

  • Context: The Microsoft Defender service (MsMpEng.exe) uses WMI interfaces to monitor file system changes and retrieve process attributes in real-time. This continuous interaction generates a steady stream of WMI events that can be misidentified as an attacker enumerating the environment.