
title: Windows Management Instrumentation DLL Loaded Via Microsoft Word
author: Michael R. (@nahamike01)
date: 2019/12/26
description: Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands
detection:
  SELECTION_1:
    EventID: 7
  SELECTION_2:
    Image:
    - '*\winword.exe'
    - '*\powerpnt.exe'
    - '*\excel.exe'
    - '*\outlook.exe'
  SELECTION_3:
    ImageLoaded:
    - '*\wmiutils.dll'
    - '*\wbemcomn.dll'
    - '*\wbemprox.dll'
    - '*\wbemdisp.dll'
    - '*\wbemsvc.dll'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Possible. Requires further testing.
id: a457f232-7df9-491d-898f-b5aabd2cbe2f
level: high
logsource:
  category: image_load
  product: windows
references:
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
- https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/
- https://media.cert.europa.eu/static/SecurityAdvisories/2019/CERT-EU-SA2019-021.pdf
status: experimental
tags:
- attack.execution
- attack.t1047
ruletype: SIGMA
