file_event_win_wmiexec_default_filename.yml

title: Wmiexec Default Output File
id: 8d5aca11-22b3-4f22-b7ba-90e60533e1fb
status: experimental
description: Detects the creation of the default output filename used by the wmicexec tool
references:
    - https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
author: Nasreddine Bencherchali
date: 2022/06/02
tags:
    - attack.lateral_movement
    - attack.t1047
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|re: '\\Windows\\__1\d{9}\.\d{1,7}$'
    condition: selection
falsepositives:
    - Unlikely
level: critical