attack.t1546.003 | Detection.FYI

New ActiveScriptEventConsumer Created Via Wmic.EXE

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Read More
Powershell WMI Persistence

Aug 12, 2024 · attack.privilege-escalation attack.t1546.003 ·
Share on:

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Read More
Suspicious Encoded Scripts in a WMI Consumer

Aug 12, 2024 · attack.execution attack.t1047 attack.persistence attack.t1546.003 ·
Share on:

Detects suspicious encoded payloads in WMI Event Consumers

Read More
WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load

Aug 12, 2024 · attack.lateral-movement attack.privilege-escalation attack.persistence attack.t1546.003 ·
Share on:

Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.

Read More
WMI Backdoor Exchange Transport Agent

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Read More
WMI Event Subscription

Aug 12, 2024 · attack.persistence attack.t1546.003 ·
Share on:

Detects creation of WMI event subscription persistence method

Read More
WMI Persistence

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
WMI Persistence - Command Line Event Consumer

Aug 12, 2024 · attack.t1546.003 attack.persistence ·
Share on:

Detects WMI command line event consumers

Read More
WMI Persistence - Script Event Consumer

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects WMI script event consumers

Read More
WMI Persistence - Script Event Consumer File Write

Aug 12, 2024 · attack.t1546.003 attack.persistence ·
Share on:

Detects file writes of WMI script event consumer

Read More
WMI Persistence - Security

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.003 ·
Share on:

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Read More
MOFComp Execution

Jan 8, 2023 · attack.execution attack.t1546.003 ·
Share on:

Detects abuse of mofcomp to load WMI classes i.e. to create WMI event subscriptions

Read More