Windows WMI Impersonate Token

name: Windows WMI Impersonate Token
id: cf192860-2d94-40db-9a51-c04a2e8a8f8b
version: 11
creation_date: '2022-10-26'
modification_date: '2026-09-08'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects WMI token impersonation by identifying `wmiprvse.exe` requesting the query, VM, and duplicate-handle rights associated with WMI process access.
    It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_QUERY_INFORMATION (0x400), PROCESS_QUERY_LIMITED_INFORMATION (0x1000), PROCESS_VM_OPERATION (0x8), PROCESS_VM_READ (0x10), PROCESS_VM_WRITE (0x20), PROCESS_DUP_HANDLE (0x40), and PROCESS_ALL_ACCESS (0x1f3fff).
data_source:
    - Sysmon EventID 10
search: |-
    `sysmon`
    EventCode=10
    SourceImage="*\\wmiprvse.exe"

    ```
    The 0x1478 mask combines query, VM, and duplicate-handle rights;
    The 0x1fffff mas is full process access.
    Additional requested rights are allowed.
    ```
    | eval g_access_decimal = tonumber(replace(GrantedAccess,"0x",""),16)
    | eval PROCESS_QUERY_INFORMATION = 1024
    | eval PROCESS_QUERY_LIMITED_INFORMATION = 4096
    | eval PROCESS_VM_OPERATION = 8
    | eval PROCESS_VM_READ = 16
    | eval PROCESS_VM_WRITE = 32
    | eval PROCESS_DUP_HANDLE = 64
    | eval WMI_REQUIRED_ACCESS = PROCESS_QUERY_INFORMATION + PROCESS_QUERY_LIMITED_INFORMATION + PROCESS_VM_OPERATION + PROCESS_VM_READ + PROCESS_VM_WRITE + PROCESS_DUP_HANDLE
    | eval PROCESS_ALL_ACCESS = 2097151
    | eval wmi_access_set = bit_and(g_access_decimal, WMI_REQUIRED_ACCESS)
    | eval full_access_set = bit_and(g_access_decimal, PROCESS_ALL_ACCESS)
    | where wmi_access_set == WMI_REQUIRED_ACCESS
      OR full_access_set == PROCESS_ALL_ACCESS

    | stats count min(_time) as firstTime
                    max(_time) as lastTime
        BY user_id dest
           signature_id signature granted_access Opcode
           SourceImage SourceProcessGUID SourceProcessId
           TargetImage TargetProcessGUID TargetProcessId
           CallTrace vendor_product

    | eval CallTrace=split(CallTrace, "|")

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `windows_wmi_impersonate_token_filter`
how_to_implement: This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
known_false_positives: administrator may execute impersonate wmi object script for auditing. Filter is needed.
references:
    - https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/process-access.md
    - https://www.joesandbox.com/analysis/278341/0/html
drilldown_searches:
    - name: View the detection results for - "$dest$"
      search: '%original_detection_search% | search  dest = "$dest$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$dest$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: dest
          type: system
          score: 20
          message: The [$SourceImage$] requested the access mask [$granted_access$] from [$TargetImage$] on [$dest$]. This may indicate WMI token impersonation.
threat_objects:
    - field: SourceImage
      type: file_path
analytic_story:
    - Qakbot
    - Water Gamayun
asset_type: Endpoint
mitre_attack_id:
    - T1047
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: endpoint
security_domain: endpoint
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log
          source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
          sourcetype: XmlWinEventLog
      test_type: unit