WMIC Loading Scripting Libraries

Hunt Hypothesis

Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the /FORMAT argument switch to download and execute an XSL file (i.e js, vbs, etc). It could be a

Detection Rule

Sigma (Original)

title: WMIC Loading Scripting Libraries
id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32
related:
    - id: 8d63dadf-b91b-4187-87b6-34a1114577ea
      type: similar
    - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
      type: similar
status: test
description: |
    Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
    It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.
references:
    - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html
    - https://twitter.com/dez_/status/986614411711442944
    - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-10-17
modified: 2022-10-13
tags:
    - attack.defense-evasion
    - attack.t1220
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        ImageLoaded|endswith:
            - '\jscript.dll'
            - '\vbscript.dll'
    condition: selection
falsepositives:
    - The command wmic os get lastbootuptime loads vbscript.dll
    - The command wmic os get locale loads vbscript.dll
    - Since the ImageLoad event doesn't have enough information in this case. It's better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
    - The command `wmic ntevent` loads vbscript.dll
level: medium

KQL (Microsoft 365 Defender)

DeviceImageLoadEvents
| where InitiatingProcessFolderPath endswith "\\wmic.exe" and (FolderPath endswith "\\jscript.dll" or FolderPath endswith "\\vbscript.dll")

Required Data Sources

Sentinel Table	Notes
`DeviceImageLoadEvents`	Ensure this data connector is enabled

False Positive Guidance

The command wmic os get lastbootuptime loads vbscript.dll
The command wmic os get locale loads vbscript.dll
Since the ImageLoad event doesn’t have enough information in this case. It’s better to look at the recent process creation events that spawned the WMIC process and investigate the command line and parent/child processes to get more insights
The command wmic ntevent loads vbscript.dll

MITRE ATT&CK Context

Tactic: Defense Evasion
Technique: T1220 — XSL Script Processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing

Validation (Atomic Red Team)

Use these Atomic Red Team tests to validate this detection fires correctly:

T1220 — XSL Script Processing