Detection: Impacket Lateral Movement WMIExec Commandline Parameters

Description

This analytic looks for the presence of suspicious commandline parameters typically present when using Impacket tools. Impacket is a collection of python classes meant to be used with Microsoft network protocols. There are multiple scripts that leverage impacket libraries like wmiexec.py, smbexec.py, dcomexec.py and atexec.py used to execute commands on remote endpoints. By default, these scripts leverage administrative shares and hardcoded parameters that can be used as a signature to detect its use. Red Teams and adversaries alike may leverage Impackets tools for lateral movement and remote code execution.

Annotations

No annotations available.

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.

Associated Analytic Story

• Active Directory Lateral Movement

• CISA AA22-277A

• WhisperGate

• Prestige Ransomware

• Volt Typhoon

• Graceful Wipe Out Attack

• Industroyer2

• Data Destruction

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1021/002/

• https://attack.mitre.org/techniques/T1021/003/

• https://attack.mitre.org/techniques/T1047/

• https://attack.mitre.org/techniques/T1053/

• https://attack.mitre.org/techniques/T1053/005/

• https://github.com/SecureAuthCorp/impacket

• https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Version: 1