WMI Persistence — Sigma Rule

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community. Source status: test; severity: medium. Source dates: 2017-08-22 / 2022-02-10.

{
  "product": "windows",
  "service": "wmi",
  "definition": "WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 4e79a1e2a6914ad09a9193e41f5a27ead2dc0876ac835099bac516ca49a28c8f

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: WMI Persistence
id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b
status: test
description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
references:
    - https://twitter.com/mattifestation/status/899646620148539397
    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
date: 2017-08-22
modified: 2022-02-10
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1546.003
logsource:
    product: windows
    service: wmi
    definition: 'WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher'
detection:
    wmi_filter_to_consumer_binding:
        EventID: 5861
    consumer_keywords:
        - 'ActiveScriptEventConsumer'
        - 'CommandLineEventConsumer'
        - 'CommandLineTemplate'
        # - 'Binding EventFilter'  # too many false positive with HP Health Driver
    wmi_filter_registration:
        EventID: 5859
    filter_scmevent:
        Provider: 'SCM Event Provider'
        Query: 'select * from MSFT_SCMEventLogEvent'
        User: 'S-1-5-32-544'
        PossibleCause: 'Permanent'
    condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent
falsepositives:
    - Unknown (data set is too small; further testing needed)
level: medium

Original YAML and metadata in JSON

False positives

• Unknown (data set is too small; further testing needed)

Source references

• https://twitter.com/mattifestation/status/899646620148539397
• https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/