WMIC-WMI for Incident Response and Threat Hunting

Hello everyone, in this article I will talk about what WMI and WMIC are, which play an important role in Incident Response, Threat Hunting, and detecting attacks, along with the commands used here and their purposes. I hope it’s useful, happy reading in advance. :)

First, let’s explain these 2 important terms;

WMIC = Windows Management Instrumentation Command-line
WMI = Windows Management Instrumentation (WMI)

Windows Management Instrumentation Command-line (WMIC) is a software utility that allows users to perform Windows Management Instrumentation (WMI) operations through a command prompt.

WMI

Windows Management Instrumentation (WMI) is a PowerShell subsystem that gives system administrators access to system monitoring tools. This system is designed to allow system management to be carried out quickly and efficiently. Generally, administrators use WMI on systems to do the following:

configure systems,
execute processes or scripts,
automate tasks…

However, even though WMI was originally designed to carry out these operations, it’s also misused by attackers and hacker groups. This shows us just how alarming WMI can actually be.

The features that make WMI useful for administrators are also considerably attractive to an attacker. WMI can perform the features we’ve mentioned on both local and remote systems. As you might expect, this also makes it usable by attackers for lateral movement.

Because WMI is generally seen as routine, normal activity within our systems, it makes detecting malicious activity a bit harder. For this reason, this activity must be examined very carefully by analysts.

Attackers generally use WMI for the following purposes;

lateral movement,
gathering information,
modifying systems…

A WMI lateral movement technique frequently carried out using wmic.exe looks like this:

wmic.exe /node: process call create

If your security systems log logon events, a type(3) logon activity associated with this event will be displayed.

As another method, attackers gather information and make changes within systems. During ransomware attacks, attackers generally delete Volume Shadow Copy information, which allows files to be recovered. The following command is used to do this.

wmic shadowcopy delete /noninteractive

wmic process call create vssadmin.exe delete shadows /all /quiet

From a defender’s perspective, when attackers carry out the activities described above, we need to be able to see and catch them. We can use the following commands to detect and catch this activity.

process == wmic.exe
 &&
command_line_includes ('create' || 'node:' || 'process' || 'call')

process == wmic.exe
&&
command_line_includes ('shadowcopy' && 'delete')

In addition to these types of attacks, attackers can also use WMIC for the following purposes;

determining which antivirus product can be installed,
stopping the firewall service,
enumerating group membership (local and, in many configurations, including domain admin accounts)…

Collecting Logs

To protect ourselves against the attacks mentioned in this section and to make sure they can be examined by analysts, the relevant security logs should be collected from Windows events, Sysmon, and other sources.

Windows Event ID 4688: Process Creation

As with many other attack techniques, logging process creation events (4688) while command-line logging is enabled can be a rich data source. In other words, Event ID 4688 is one of the most important pieces for observing WMI and other activity, and for distinguishing normal, legitimate activity from abnormal and suspicious activity.

Sysmon Event IDs 19, 20, and 21: WmiEvents

Sysmon provides functionality that can be useful for observing the malicious use of WMI (for example, 19: WmiEventFilter activity detected, 20: WmiEventConsumer activity detected, or 21: WmiEventConsumerToFilter activity detected). Sysmon logs persistent WMI subscriptions in the Microsoft-Windows-Sysmon/Operational event log using Event IDs 19, 20, and 21 for event filter creation, event consumer creation, and other actions. Malware occasionally takes advantage of these WMI features, and this is easy to monitor for malicious use.

Windows Event ID 5861: Microsoft-Windows-WMI-Activity/Operational

Event ID 5861 in the Microsoft-Windows-WMI-Activity/Operational event log reliably logs persistent WMI event subscriptions. A persistent event is the primary way an adversary achieves persistence using WMI. This persistence mechanism gives an attacker an enormous degree of control over the target system.

Incident Response with WMIC

During incident response, WMIC queries can be used to view operating system information, network information, running processes, running services, user account information, and other evidentiary information from live systems.

Now let’s go over some wmic commands used during Incident Response;

Used to gather information from the machine under examination.

wmic computersystem list brief

Used to gather information about the operating system.

wmic os list brief

wmic os get Version, Caption, CountryCode, CSName, Description, InstallDate, SerialNumber, ServicePackMajorVersion, WindowsDirectory /format:list

To get information about the CPU,

wmic cpu get processorID
wmic cpu List instance
wmic cpu get Name, Caption, MaxClockSpeed, DeviceID, status

To identify applications that run at computer startup;

wmic startup get Caption, Command, Location, User

To find services set to start automatically;

wmic service where StartMode="Auto" get Name, State

To get information about environment variables;

wmic environment get Description, Name, SystemVariable, VariableValue

To get information about groups

wmic group Caption, InstallDate, LocalAccount, Domain, SID, Status

To get information about the list of all running processes

wmic process get Caption, CommandLine, Handle, HandleCount, PageFaults, PageFileUsage, PArentProcessId, ProcessId, ThreadCount
wmic process get name, processid, parentprocessid, executablepath

To identify and analyze a specific process manipulated by attackers, such as “svchost.exe”

wmic process where (Name='svchost.exe') get name, processid, parentprocesid, executablepath

To find the list of currently logged-on users.

wmic computersystem get name, username

To get a list of all users on the suspicious system and their attributes.

wmic useraccount get Name, Domain, AccountType InstallDate, SID, Lockout

To determine where the pagefile.sys file is located and get some information related to it.

wmic pagefile get Caption, CurrentUsage, Status, TempPageFile

Identify all enabled local system accounts (guest, etc.)

wmic useraccount WHERE "Disabled=0 AND LocalAccount=1" GET Name

To get users’ logon information

wmic netlogin get Name, Fullname, ScriptPath, Profile, UserID, NumberOfLogons, PasswordAge, LogonServer, HomeDirectory, PrimaryGroupID

To get information about system accounts

wmic sysaccount get Caption, Domain, Name, SID, SIDType, Status

Thank you for reading this far. :)

Sources: