Remote WMI DLL Hijack via wbemcomn.dll Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•24

Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').