detect-office-products-spawning-wmic

This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve. Windows Management Instrumentation, or WMI, is a legitimate Microsoft framework used to obtain management data and perform administrative tasks on remote devices. However, attackers can also use WMI to gather information about a target or hijack control of a device. The MITRE ATT&CK framework includes WMI among its list of common enterprise attack techniques. The following query detects when Microsoft Office software spawns an instance of the WMI command-line utility, wmic.exe. References: https://docs.microsoft.com/windows/win32/wmisdk/about-wmi https://attack.mitre.org/techniques/T1047/