Unusual Module Loads - WMI

SIGMA detection rule by RedCanary, Sigma formatting by Micah Babinski · GPL-3.0

By monitoring and detecting on module loads, you can catch a variety of different malicious activities, including defense evasion and credential theft. In cases where an adversary is using WMI for credential theft, consider looking for the execution of wmiprvse.exe (or its child processes) with unusual module loads like samlib.dll or vaultcli.dll. WMI is also a useful vehicle for bypassing application controls, and we commonly see adversaries—real and simulated–using a WMI bypass method called “SquibblyTwo.” The following pseudo-detection analytic is designed specifically to catch application control bypasses, but you can likely adapt it to detect other threats by substituting in a different DLL or by removing the command. Part of the RedCanary 2024 Threat Detection Report.

title: Unusual Module Loads - WMI
id: b62ec77f-8014-42be-9874-c155f9ce6fae
status: experimental
description: |
    By monitoring and detecting on module loads, you can catch a variety of different malicious 
    activities, including defense evasion and credential theft. In cases where an adversary is 
    using WMI for credential theft, consider looking for the execution of wmiprvse.exe (or its 
    child processes) with unusual module loads like samlib.dll or vaultcli.dll. WMI is also a 
    useful vehicle for bypassing application controls, and we commonly see adversaries—real and 
    simulated–using a WMI bypass method called “SquibblyTwo.” The following pseudo-detection 
    analytic is designed specifically to catch application control bypasses, but you can likely 
    adapt it to detect other threats by substituting in a different DLL or by removing the command. 
    Part of the RedCanary 2024 Threat Detection Report.
references:
    - https://redcanary.com/threat-detection-report/techniques/windows-management-instrumentation/
author: RedCanary, Sigma formatting by Micah Babinski
date: 2024/03/21
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\wmic.exe'
        CommandLine|contains: 'format:' # this field may not be available
        ImageLoaded|contains:
            - 'jscript.dll'
            - 'vbscript.dll'
    condition: selection
falsepositives:
    - Unknown
level: low

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1af0b533-a041-44fc-a2fe-f87301d0d621

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion