PowerShell WMI Query for Unquoted Service Paths

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects PowerShell scripts that query WMI for service information, specifically looking for the 'Win32_Service' class and requesting 'Name', 'DisplayName', 'PathName', and 'StartMode' properties. This activity is often associated with reconnaissance for unquoted service path vulnerabilities, a common technique used by penetration testers and attackers for privilege escalation.