IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Persistence via Update Orchestrator Service Hijack Web Shell Detection: Script Process Child of Common Web Processes »

› ›

Persistence via WMI Event Subscription

edit

Persistence via WMI Event Subscription

edit

An adversary can use Windows Management Instrumentation (WMI) to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.

Rule type: eql

Rule indices:

logs-endpoint.events.*
winlogbeat-*
logs-windows.*

Severity: low

Risk score: 21

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

Elastic
Host
Windows
Threat Detection
Persistence

Version: 101

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Rule query

edit

process where event.type == "start" and
  (process.name : "wmic.exe" or process.pe.original_file_name == "wmic.exe") and
  process.args : "create" and
  process.args : ("ActiveScriptEventConsumer", "CommandLineEventConsumer")

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
Technique:
- Name: Event Triggered Execution
- ID: T1546
- Reference URL: https://attack.mitre.org/techniques/T1546/
Sub-technique:
- Name: Windows Management Instrumentation Event Subscription
- ID: T1546.003
- Reference URL: https://attack.mitre.org/techniques/T1546/003/

« Persistence via Update Orchestrator Service Hijack Web Shell Detection: Script Process Child of Common Web Processes »