Techniques
Sample rules
Windows WMI Impersonate Token
- source: splunk
- technicques:
Description
The following analytic detects WMI token impersonation by identifying wmiprvse.exe requesting the query, VM, and duplicate-handle rights associated with WMI process access.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff).
Detection logic
`sysmon`
EventCode=10
SourceImage="*\\wmiprvse.exe"
The 0x1478 mask combines query, VM, and duplicate-handle rights; The 0x1fffff mas is full process access. Additional requested rights are allowed.
| eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
| eval PROCESS_QUERY_INFORMATION = 1024
| eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
| eval PROCESS_VM_OPERATION = 8
| eval PROCESS_VM_READ = 16
| eval PROCESS_VM_WRITE = 32
| eval PROCESS_DUP_HANDLE = 64
| eval WMI_REQUIRED_ACCESS = PROCESS_QUERY_INFORMATION + PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_OPERATION + PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_DUP_HANDLE
| eval PROCESS_ALL_ACCESS = 2097151
| eval wmi_access_set = bit_and(g_access_decimal, WMI_REQUIRED_ACCESS)
| eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS)
| where wmi_access_set == WMI_REQUIRED_ACCESS
OR full_access_set == PROCESS_ALL_ACCESS
| stats count min(_time) as firstTime
max(_time) as lastTime
BY user_id dest
signature_id signature granted_access Opcode
SourceImage SourceProcessGUID SourceProcessId
TargetImage TargetProcessGUID TargetProcessId
CallTrace vendor_product
| eval CallTrace=split(CallTrace, "
|")
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_wmi_impersonate_token_filter`