WMImplant Hack Tool
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
WMImplant Hack Tool | Standard | Windows | Execution: Command and Scripting Interpreter - PowerShell (T1059.001), Execution: Windows Management Instrumentation (T1047) | Trouble |
About the rule
Rule Type
Standard
Rule Description
WMImplant is a post-exploitation tool used by attackers to leverage Windows Management Instrumentation (WMI) for remote command execution and system control on Windows systems. It abuses the native integration with the Windows OS.
Severity
Trouble
Rule journey
Attack chain scenario
Initial access (through phishing) → Execution → Credential Access → Command and Control → Impact
Impact
- The attacker uses WMImplant to execute remote commands on other systems via WMI without dropping a binary to disk.
- WMImplant can be used alongside other tools/scripts to collect credentials from LSASS or SAM.
- Data encryption
Rule Requirement
Prerequisites
- Log in to the Group Policy Management Console (GPMC) with domain admin credentials.
- In the Group Policy Management Editor, go to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Powershell and enable Turn on Module Logging.
- In the Options pane, click on Show, and in the Module Name, enter * to record all modules, and press OK.
- In the Group Policy Management Editor, go to Computer Configuration and Turn on PowerShell Script Block Logging.
- Create a new registry key "Microsoft-Windows-Powershell/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\".
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND SCRIPTEXECUTED contains "WMImplant, change_user , gen_cli , command_exec , disable_wdigest , disable_winrm , enable_wdigest , enable_winrm , registry_mod , remote_posh , sched_job , service_mod , process_kill , active_users , basic_info , power_off , vacant_system , logon_events " select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Execution: Command and Scripting Interpreter - PowerShell (T1059.001), Execution: Windows Management Instrumentation (T1047)
Security Standards
Enabling this rule will help you meet the security standard's requirements listed below:
PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
Security administrators ensure to draft and implement strict privilege permission for critical operations of certification and the usage of WMI. Leverage IAM and SIEM solutions to ensure access permission and authorizations and regular auditing practices.
DE.CM-01: Networks and network services are monitored to find potentially adverse events.
Security administrators have to continuously monitor all the network and its services in real-time using SIEM tools and identify the unusual behavior during the usage of WMI. Enforce the policies on the web traffic to ensure the network security.
Author
NVISO
Future actions
Known False Positives
A instance of false positive WMImplant Hack Tool is detected when legitimate administrative activities that resemble the tool’s behavior, particularly when using WMI for remote management tasks such as custom IT automations tools, and scripting administration.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify the event and check if the flagged incident is new or part of an existing one.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and kill or terminate the malicious process.
- Reconfiguration: Update the network policies and port configurations and continuously monitor traffic trends in the network.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1038 | Use security applications to configure and block the execution of Windows utilities or Windows APIs to prevent potential exploitation by adversaries. | |
M1049 | Quarantine the suspicious files or folders or any materials using anti-virus application. | |
M1045 | Ensure to configure policies for PowerShell execution restricting to signed scripts only. | |
M1042 | To reduce risk, consider disabling or restricting the WinRM service to limit PowerShell-based remote execution. Restrict its usage when it is not required. | |
M1026 | Through policy settings ensure the PowerShell execution to critical user accounts. Use PowerShell Just Enough Administration (JEA) to restrict available commands and control user actions during remote sessions. | |
M1040 | Especially in Windows 10 systems, enable Attack Surface Reduction (ASR) rules to prevent VBA macros from calling WIN32 APIs. | |
M1018 | Update policies to limit user accounts' access and privileges and use Service Control Policies to restrict API calls. |
