Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

WMI Recon Running Process Or Services

The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. This detection leverages PowerShell Script Block…

Description

The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI performs an event query to list running processes or services. This detection leverages PowerShell Script Block Logging to capture and analyze script block text for specific WMI queries. This activity is significant as it is commonly used by malware and APT actors to map security applications or services on a compromised machine. If confirmed malicious, this could allow attackers to identify and potentially disable security defenses, facilitating further compromise and persistence within the environment.

Detection logic

Detection requirements

Platform
PRE

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
powershell_script_block_logging_4104

Known benign triggers

  • Network administrator may used this command for checking purposes

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice