Question

A threat intelligence report describes an adversary that uses Windows Management Instrumentation (WMI) to remotely execute commands on target hosts (mapped to MITRE ATT&CK T1047). Your detection engineering team wants to build a YARA-L rule that generalizes to this technique rather than matching only the specific tool hashes named in the report. Which approach best translates the intelligence into durable, behavior-based detection coverage?

Accepted Answer

Write a rule matching process events where the parent process is WmiPrvSE.exe spawning command interpreters, and tag it with the T1047 technique in the rule metadata.

Answer

Write a single-event rule that matches on the specific SHA-256 hashes of the tools listed in the report so alerts fire immediately on known indicators.

Answer

Create a reference list of the adversary's C2 domains and write a rule that alerts on any DNS resolution to those domains.

Answer

Write a rule that alerts whenever wmic.exe executes on any host, regardless of parent, child, or command-line context.