🐾 - 🔔 DNSCache WMI Reply 🪟 - Possible Lateral Movement 🥷 - T1021.006 - Suricata Rule 3300324 (pawpatrules)

🐾 - 🔔 DNSCache WMI Reply 🪟 - Possible Lateral Movement 🥷 - T1021.006

SID: 3300324Rev: 65 views

Sourcepawpatrules

CreatedJuly 14, 2023

UpdatedJuly 17, 2023

Classificationattempted-recon

alert tcp $HOME_NET any -> any any (msg:"🐾 - 🔔 DNSCache WMI Reply 🪟 - Possible Lateral Movement 🥷 - T1021.006"; flow:to_client, stateless; content:"|05 00 02 03|"; content:"|4d 53 46 54 5f 44 4e 53 43 6c 69 65 6e 74 43 61 63 68 65|"; fast_pattern; reference:url,https://wikipedia.org/wiki/Windows_Management_Instrumentation; reference:url,https://github.com/GhostPack/Seatbelt#remote-enumeration; reference:url,https://attack.mitre.org/techniques/T1021/006/; classtype:attempted-recon; sid:3300324; rev:6; metadata:created_at 2023_07_14, updated_at 2023_07_17;)

References

url	https://wikipedia.org/wiki/Windows_Management_Instrumentation
url	https://github.com/GhostPack/Seatbelt#remote-enumeration
url	https://attack.mitre.org/techniques/T1021/006/

🐾 - 🔔 DNSCache WMI Reply 🪟 - Possible Lateral Movement 🥷 - T1021.006

References

Metadata

Comments (0)