WMI Persistence

 1title: WMI Persistence
 2id: 0b7889b4-5577-4521-a60a-3376ee7f9f7b
 3status: test
 4description: Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
 5references:
 6    - https://twitter.com/mattifestation/status/899646620148539397
 7    - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
 8author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
 9date: 2017/08/22
10modified: 2022/02/10
11tags:
12    - attack.persistence
13    - attack.privilege_escalation
14    - attack.t1546.003
15logsource:
16    product: windows
17    service: wmi
18    definition: 'WMI Namespaces Auditing and SACL should be configured, EventID 5861 and 5859 detection requires Windows 10, 2012 and higher'
19detection:
20    wmi_filter_to_consumer_binding:
21        EventID: 5861
22    consumer_keywords:
23        - 'ActiveScriptEventConsumer'
24        - 'CommandLineEventConsumer'
25        - 'CommandLineTemplate'
26        # - 'Binding EventFilter'  # too many false positive with HP Health Driver
27    wmi_filter_registration:
28        EventID: 5859
29    filter_scmevent:
30        Provider: 'SCM Event Provider'
31        Query: 'select * from MSFT_SCMEventLogEvent'
32        User: 'S-1-5-32-544'
33        PossibleCause: 'Permanent'
34    condition: ( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent
35falsepositives:
36    - Unknown (data set is too small; further testing needed)
37level: medium