{"id":"f033f3f3-fd24-4995-97d8-a3bb17550a88","title":"WMI Persistence - Security","description":"Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.","author":"Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community","status":"test","level":"medium","date":"2017-08-22","modified":"2022-11-29","tags":["attack.persistence","attack.privilege-escalation","attack.t1546.003"],"technique_ids":["T1546.003"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Unknown (data set is too small; further testing needed)"],"references":["https://twitter.com/mattifestation/status/899646620148539397","https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/"],"source_path":"rules/windows/builtin/security/win_security_wmi_persistence.yml","source_sha256":"c47d230c48b3482c4b7f996b81a978ff1e77df896df7dfe12f55f2087f2a22c7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_wmi_persistence.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: WMI Persistence - Security\nid: f033f3f3-fd24-4995-97d8-a3bb17550a88\nrelated:\n    - id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b\n      type: derived\nstatus: test\ndescription: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.\nreferences:\n    - https://twitter.com/mattifestation/status/899646620148539397\n    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/\nauthor: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community\ndate: 2017-08-22\nmodified: 2022-11-29\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1546.003\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 4662\n        ObjectType: 'WMI Namespace'\n        ObjectName|contains: 'subscription'\n    condition: selection\nfalsepositives:\n    - Unknown (data set is too small; further testing needed)\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1546.003","id":"T1546.003","name":"Windows Management Instrumentation Event Subscription","page":"techniques/enterprise/T1546.003/"}],"data_path":"data/detection-rules/f033f3f3-fd24-4995-97d8-a3bb17550a88.json","kind":"sigma"}