sigmamediumHunting

WMI Persistence

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

MITRE ATT&CK

persistenceprivilege-escalation

Detection Query

wmi_filter_to_consumer_binding:
  EventID: 5861
consumer_keywords:
  - ActiveScriptEventConsumer
  - CommandLineEventConsumer
  - CommandLineTemplate
wmi_filter_registration:
  EventID: 5859
filter_scmevent:
  Provider: SCM Event Provider
  Query: select * from MSFT_SCMEventLogEvent
  User: S-1-5-32-544
  PossibleCause: Permanent
condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or
  (wmi_filter_registration) ) and not filter_scmevent

Author

Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community

Created

2017-08-22

Data Sources

windowswmi

Platforms

windows

References

Tags

attack.persistenceattack.privilege-escalationattack.t1546.003

Raw Content

title: WMI Persistence
id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b
status: test
description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
references:
    - https://twitter.com/mattifestation/status/899646620148539397
    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
date: 2017-08-22
modified: 2022-02-10
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1546.003
logsource:
    product: windows
    service: wmi
    definition: 'WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher'
detection:
    wmi_filter_to_consumer_binding:
        EventID: 5861
    consumer_keywords:
        - 'ActiveScriptEventConsumer'
        - 'CommandLineEventConsumer'
        - 'CommandLineTemplate'
        # - 'Binding EventFilter'  # too many false positive with HP Health Driver
    wmi_filter_registration:
        EventID: 5859
    filter_scmevent:
        Provider: 'SCM Event Provider'
        Query: 'select * from MSFT_SCMEventLogEvent'
        User: 'S-1-5-32-544'
        PossibleCause: 'Permanent'
    condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent
falsepositives:
    - Unknown (data set is too small; further testing needed)
level: medium