title: SquiblyTwo
author: Markus Neis / Florian Roth
date: 2019/01/16
description: Detects WMI SquiblyTwo Attack with possible renamed WMI by looking for
  imphash
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    CommandLine: '*http*'
  SELECTION_3:
    Image:
    - '*\wmic.exe'
  SELECTION_4:
    CommandLine: '*wmic*'
  SELECTION_5:
    CommandLine: '*format*'
  SELECTION_6:
    Imphash:
    - 1B1A3F43BF37B5BFE60751F2EE2F326E
    - 37777A96245A3C74EB217308F3546F4C
    - 9D87C9D67CE724033C0B40CC4CA1B206
  SELECTION_7:
    CommandLine: '*format:*'
  condition: (SELECTION_1 and SELECTION_2 and ((SELECTION_3 and SELECTION_4 and SELECTION_5)
    or (SELECTION_6 and SELECTION_7)))
falsepositives:
- Unknown
id: 8d63dadf-b91b-4187-87b6-34a1114577ea
level: medium
logsource:
  category: process_creation
  product: windows
modified: 2020/08/27
references:
- https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
- https://twitter.com/mattifestation/status/986280382042595328
status: experimental
tags:
- attack.defense_evasion
- attack.t1047
- attack.t1220
- attack.execution
- attack.t1059.005
- attack.t1059.007
- attack.t1059
ruletype: SIGMA