Remote DLL Execution via WMIC and WMIPRVSE

SIGMA detection rule by Momen Mahmoud

Detects potential malicious remote DLL using WMIC: - On the source machine, a command shell (cmd.exe or powershell.exe) executing WMIC with parameters (including "/node:", "call", and "rundll32") indicating remote process creation. - On the target machine, a rundll32.exe process that is spawned by WMIPRVSE.exe.

title: Remote DLL Execution via WMIC and WMIPRVSE
id: 83d3000e-31c6-41ba-9083-fbd484c276fb
status: experimental
description: |
  Detects potential malicious remote DLL using WMIC:
  - On the source machine, a command shell (cmd.exe or powershell.exe) executing WMIC with parameters 
    (including "/node:", "call", and "rundll32") indicating remote process creation.
  - On the target machine, a rundll32.exe process that is spawned by WMIPRVSE.exe.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a :contentReference[oaicite:0]{index=0}
author: Momen Mahmoud
date: 2025-02-12
tags:
  - attack.execution
  - attack.t1047
  - attack.t1218.011a
logsource:
  category: process_creation
  product: windows
detection:
  selection_source:
    Image|endswith:
      - 'cmd.exe'
      - 'powershell.exe'
    CommandLine|contains|all:
      - 'wmic'
      - '/node:'
      - 'call'
      - 'rundll32'
  selection_target:
    ParentImage|endswith:
      - 'WMIPRVSE.exe'
    Image|endswith:
      - 'rundll32.exe'
  condition: selection_source or selection_target
falsepositives:
  - Legitimate remote administration using WMIC (tuning may be needed based on environment)
level: high

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

24979f65-27eb-4821-90d1-3b855ecd09f9

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion