Detectionhightest

WMI Persistence - Script Event Consumer File Write

Detects file writes of WMI script event consumer

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Thomas PatzkeCreated Wed Mar 07Updated Sat Nov 2733f41cdd-35ac-4ba8-814b-c6a4244a1ad4windows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        Image: 'C:\WINDOWS\system32\wbem\scrcons.exe'
    condition: selection

False Positives

Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

33f41cdd-35ac-4ba8-814b-c6a4244a1ad4

Status

test

Level

high

Type

Detection

Created

Wed Mar 07

Modified

Sat Nov 27

Author

Path

rules/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml

Raw Tags

attack.privilege-escalationattack.t1546.003attack.persistence