{"id":"0b7889b4-5577-4521-a60a-3376ee7f9f7b","title":"WMI Persistence","description":"Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.","author":"Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community","status":"test","level":"medium","date":"2017-08-22","modified":"2022-02-10","tags":["attack.persistence","attack.privilege-escalation","attack.t1546.003"],"technique_ids":["T1546.003"],"logsource":{"product":"windows","service":"wmi","definition":"WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher"},"falsepositives":["Unknown (data set is too small; further testing needed)"],"references":["https://twitter.com/mattifestation/status/899646620148539397","https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/"],"source_path":"rules/windows/builtin/wmi/win_wmi_persistence.yml","source_sha256":"4e79a1e2a6914ad09a9193e41f5a27ead2dc0876ac835099bac516ca49a28c8f","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/wmi/win_wmi_persistence.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WMI Persistence\nid: 0b7889b4-5577-4521-a60a-3376ee7f9f7b\nstatus: test\ndescription: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.\nreferences:\n    - https://twitter.com/mattifestation/status/899646620148539397\n    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/\nauthor: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community\ndate: 2017-08-22\nmodified: 2022-02-10\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1546.003\nlogsource:\n    product: windows\n    service: wmi\n    definition: 'WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher'\ndetection:\n    wmi_filter_to_consumer_binding:\n        EventID: 5861\n    consumer_keywords:\n        - 'ActiveScriptEventConsumer'\n        - 'CommandLineEventConsumer'\n        - 'CommandLineTemplate'\n        # - 'Binding EventFilter'  # too many false positive with HP Health Driver\n    wmi_filter_registration:\n        EventID: 5859\n    filter_scmevent:\n        Provider: 'SCM Event Provider'\n        Query: 'select * from MSFT_SCMEventLogEvent'\n        User: 'S-1-5-32-544'\n        PossibleCause: 'Permanent'\n    condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent\nfalsepositives:\n    - Unknown (data set is too small; further testing needed)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","page":"techniques/enterprise/T1546.003/"}],"data_path":"data/detection-rules/0b7889b4-5577-4521-a60a-3376ee7f9f7b.json","kind":"sigma"}