KQL Search

name : Credential Access - Hunting for Impacket Wmiexec activity
description : 
- There are some indicators for hunting "Impacket Wmiexec" activity
- Suspicious processes such as CMD.EXE or POWERSHELL.EXE running as a child process to WMIPRVSE.EXE are a red flag
- Execution of CMD.EXE will use the parameters of /Q /c
reference : 
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
- https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
table : 
- DeviceEvents
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceevents-table?view=o365-worldwide
- DeviceProcessEvents
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-deviceprocessevents-table?view=o365-worldwide
query : |
    //Case1
    DeviceEvents
    | where Timestamp > ago(7d)
    | where ActionType == "ProcessCreatedUsingWmiQuery" 
    | where FileName == "cmd.exe"
    | where ProcessCommandLine contains "/Q /c"
    | project Timestamp, DeviceId, DeviceName, ActionType, FolderPath, FileName, ProcessCommandLine, InitiatingProcessCommandLine


    //Case2
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessParentFileName == "WmiPrvSE.exe"
    | where InitiatingProcessFolderPath has "cmd.exe"
    | where InitiatingProcessCommandLine contains "/Q /c"
    | project Timestamp, DeviceId, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessCommandLine, ProcessCommandLine