Potential SCCM credential harvesting using WMI detected

Cortex XDR Analytics Alert Reference by data source

Product

Cortex XDR

Last date published

2025-01-19

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Execution (TA0002) Credential Access (TA0006)
ATT&CK Technique	Windows Management Instrumentation (T1047) Unsecured Credentials (T1552)
Severity	Low

Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.

Obtain credentials used by the SCCM service.

Examine the process that executed the WMI query and the CGO and verify that the processes are from a trusted source.
Inspect the system for malicious activity that is related to that process.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.

Obtain credentials used by the SCCM service.

Examine the process that executed the WMI query and the CGO and verify that the processes are from a trusted source.
Inspect the system for malicious activity that is related to that process.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Attackers or malware may use WMI queries to obtain domain credentials that are used by the SCCM.

Obtain credentials used by the SCCM service.

Examine the process that executed the WMI query and the CGO and verify that the processes are from a trusted source.
Inspect the system for malicious activity that is related to that process.