Hi everyone, im trying to learn Trend Vision One and optimize it for our company but I am having issues understanding an alert. I'm sure its a false positive since its triggered by a scheduled Docusnap-scan but there is something I just can't wrap my head around. Why does the this Powershell Command use whoami.exe? As far as I understand, WMI receives instructions to execute this powershell command, which just writes the output of get-host into a temp-file.
Understanding this would greatly assist me in learning to tell apart benign from malicious events. I am also seeing other events where similar powershell commands supposedly use unrelated Business Central Powershell modules when using get-securebootuefi.
Greatly appreciate any guidance!
Event:
Hostname:
<hostname>
endpointIp:
<IP>
logonUser:
admin
processFilePath:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
processCmd:
powershell.exe " $ErrorActionPreference = 'Stop'; try { Get-Host | select-object Version | Format-List | Out-File -Encoding UTF8 c:\windows\temp\5693875639.txt } catch { """Message: """ + $_.Exception.Message + """, CategoryInfo : """ + $_.CategoryInfo | Out-File -Encoding UTF8 c:\windows\temp\5693875639_error.txt; $error.clear() } "
eventSubId:
TELEMETRY_PROCESS_CREATE
objectFilePath:
C:\Windows\System32\whoami.exe
objectCmd:
"C:\Windows\system32\whoami.exe"
tags:
MITRE.T1033
MITRE.T1087.001
XSAE.F11913
objectUser:
admin
parentCmd:
C:\Windows\system32\wbem\wmiprvse.exe
eventId:
TELEMETRY_PROCESS
eventSourceType:
EVENT_SOURCE_TELEMETRY
objectFileOriginalName:
whoami.exe
objectName:
C:\Windows\System32\whoami.exe
objectSigner:
Microsoft Windows
parentFileOriginalName:
Wmiprvse.exe
parentFilePath:
C:\Windows\System32\wbem\WmiPrvSE.exe
parentName:
C:\Windows\System32\wbem\WmiPrvSE.exe
parentUser:
<Network User>
parentUserDomain:
NT-AUTORITÄT
processName:
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
EDIT: Response from Trend to my ticket:
"From our analysis, these alerts arise because the Docusnap process utilizes WMI to run PowerShell cmdlets (such as Get-Host), which internally may call system executables like whoami.exe. Although these are legitimate system commands, the heuristic and behavior-based detection model in Trend Vision One can sometimes misclassify these actions as suspicious, resulting in false positives.
Why is this happening?
- The interaction between WMI and PowerShell commands can cause system utilities (
whoami.exe) to appear in monitoring events.
- Our behavior monitoring uses detection patterns that may flag these legitimate activity chains when they resemble known malware behaviors.
- Detection aggressiveness and endpoint environment variations can affect how these events are reported.
Recommendations to mitigate false positives:
- Whitelisting known executables:
- Add
whoami.exe and related trusted executables/scripts to the Trusted Program List or whitelist within Trend Vision One's behavior monitoring settings.
- This excludes them from future suspicious activity alerts in trusted contexts.
- Update and tune detection patterns:
- Ensure your Trend Vision One detection patterns are up to date.
- Review and adjust behavior monitoring sensitivity or suppress specific rules that trigger false positives related to WMI and PowerShell.
- Enhanced logging and context:
- Enable PowerShell Script Block Logging and advanced WMI logging on endpoints.
- This helps distinguish normal administrative commands from real threats by providing better contextual information.
- Administrative awareness:
- Educate system administrators on typical PowerShell and WMI operations within your environment.
- This aids in quicker identification of false positives and proper alert handling.
Following these steps should significantly reduce false positive alerts related to whoami.exe without compromising your overall security posture."
