Detectionhightest

WMI Persistence - Command Line Event Consumer

Detects WMI command line event consumers

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Thomas PatzkeCreated Wed Mar 07Updated Sat Nov 2705936ce2-ee05-4dae-9d03-9a391cf2d2c6windows

Log Source

WindowsImage Load (DLL)

ProductWindows← raw: windows

CategoryImage Load (DLL)← raw: image_load

Detection Logic

detection:
    selection:
        Image: 'C:\Windows\System32\wbem\WmiPrvSE.exe'
        ImageLoaded|endswith: '\wbemcons.dll'
    condition: selection

False Positives

Unknown (data set is too small; further testing needed)

References

Resolving title…

eideon.com

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0003 · Persistence

Sub-techniques

T1546.003 · Windows Management Instrumentation Event Subscription

Rule Metadata

Rule ID

05936ce2-ee05-4dae-9d03-9a391cf2d2c6

Status

test

Level

high

Type

Detection

Created

Wed Mar 07

Modified

Sat Nov 27

Author

Thomas Patzke

Path

rules/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml

Raw Tags

attack.privilege-escalationattack.t1546.003attack.persistence

View on GitHub