UNC2452 PowerShell WMI Process Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•30

Detects a specific PowerShell command line pattern used by the UNC2452 threat group (also known as APT29 or Nobelium) for execution. The rule looks for PowerShell commands that use 'Invoke-WMIMethod win32_process -name create -argumentlist' or 'wmic /node: process call create' in conjunction with 'rundll32 c:\windows'. This pattern was observed in the SolarWinds Compromise.