CAR-2016-03-002.yaml

---
title: Create Remote Process via WMIC
submission_date: 2016/03/28
information_domain: Host
platforms:
  - Windows
subtypes:
  - Process
analytic_types:
  - TTP
contributors:
  - MITRE
id: CAR-2016-03-002
description: |
  Adversaries may use [Windows Management Instrumentation](https://attack.mitre.org/techniques/T1047) (WMI) to move laterally, by launching executables remotely.The analytic [CAR-2014-12-001](../CAR-2014-12-001) describes how to detect these processes with network traffic monitoring and process monitoring on the target host. However, if the command line utility `wmic.exe` is used on the source host, then it can additionally be detected on an analytic. The command line on the source host is constructed into something like `wmic.exe /node:"\<hostname\>" process call create "\<command line\>"`. It is possible to also connect via IP address, in which case the string `"\<hostname\>"` would instead look like `IP Address`.

  Although this analytic was created after [CAR-2014-12-001](../CAR-2014-12-001), it is a much simpler (although more limited) approach. Processes can be created remotely via WMI in a few other ways, such as more direct API access or the built-in utility [PowerShell](https://attack.mitre.org/T1059/001).
coverage:
  - technique: T1047
    tactics:
      - TA0002
    coverage: Low
implementations:
  - description: |
      Looks for instances of wmic.exe as well as the substrings in the command line:
      * `process call create`
      * `/node:`
    code: |
      processes = search Process:Create
      wmic = filter processes where (exe == "wmic.exe" and command_line == "* process call create *" and command_line == "* /node:*")
      output wmic
    type: pseudocode
  - description: Splunk version of the above pseudocode.
    code: |
      index=__your_sysmon_index__ EventCode=1 Image="C:\\Windows\\*\\wmic.exe" CommandLine="* process call create *"|search CommandLine="* /node:*"
    type: Splunk
    data_model: Sysmon native
  - description: EQL version of the above pseudocode.
    code: |
      process where subtype.create and
        (process_name == "wmic.exe" and command_line == "* process call create ")
        |filter command_line == "* /node:*"
    type: EQL
    data_model: EQL native
  - description: LogPoint version of the above pseudocode.
    code: |
      norm_id=WindowsSysmon event_id=1 image="C:\\Windows\\*\\wmic.exe" command="* process call create *" command="* /node:*"
    type: LogPoint
    data_model: LogPoint native
data_model_references:
  - process/create/exe
  - process/create/command_line
d3fend_mappings:
  - iri: d3f:ProcessSpawnAnalysis
    id: D3-PSA
    label: Process Spawn Analysis