{"id":"fe21810c-2a8c-478f-8dd3-5a287fb2a0e0","title":"Suspicious Scripting in a WMI Consumer","description":"Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro","status":"test","level":"high","date":"2019-04-15","modified":"2023-09-09","tags":["attack.execution","attack.t1059.005"],"technique_ids":["T1059.005"],"logsource":{"product":"windows","category":"wmi_event"},"falsepositives":["Legitimate administrative scripts"],"references":["https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/","https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19","https://github.com/RiccardoAncarani/LiquidSnake"],"source_path":"rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml","source_sha256":"4b2f24870af12f0e885698edd46e1363dc5154c0e1dcf1950f95b6974c3c7688","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Scripting in a WMI Consumer\nid: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0\nstatus: test\ndescription: Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers\nreferences:\n    - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/\n    - https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19\n    - https://github.com/RiccardoAncarani/LiquidSnake\nauthor: Florian Roth (Nextron Systems), Jonhnathan Ribeiro\ndate: 2019-04-15\nmodified: 2023-09-09\ntags:\n    - attack.execution\n    - attack.t1059.005\nlogsource:\n    product: windows\n    category: wmi_event\ndetection:\n    selection_destination:\n        - Destination|contains|all:\n              - 'new-object'\n              - 'net.webclient'\n              - '.downloadstring'\n        - Destination|contains|all:\n              - 'new-object'\n              - 'net.webclient'\n              - '.downloadfile'\n        - Destination|contains:\n              - ' iex('\n              - ' -nop '\n              - ' -noprofile '\n              - ' -decode '\n              - ' -enc '\n              - 'WScript.Shell'\n              - 'System.Security.Cryptography.FromBase64Transform'\n    condition: selection_destination\nfalsepositives:\n    - Legitimate administrative scripts\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.005","id":"T1059.005","name":"Visual Basic","page":"techniques/enterprise/T1059.005/"}],"data_path":"data/detection-rules/fe21810c-2a8c-478f-8dd3-5a287fb2a0e0.json","kind":"sigma"}