WMI Module Loaded By Uncommon Process
This rule detects when known WMI-related modules are loaded by processes that are not typically associated with WMI operations. It specifically looks for the loading of DLLs such as 'fastprox.dll', 'wbemcomn.dll', 'wbemprox.dll', 'wbemsvc.dll', 'WmiApRpl.dll', 'wmiclnt.dll', 'WMINet_Utils.dll', 'wmiprov.dll', and 'wmiutils.dll'. The rule then filters out common legitimate processes that are known to load these WMI modules, including executables located in standard Windows directories (Program Files, System32, SysWOW64), .NET Framework paths, explorer.exe, and specific applications like WindowsAzureGuestAgent, WaAppAgent, Thor, Microsoft Defender's MsMpEng.exe, Microsoft Teams, and Sysmon. The intent is to identify potentially malicious use of WMI by uncommon or unexpected processes, which could indicate execution, persistence, or privilege escalation attempts.
Sigma
