Detectionmediumtest

Powershell WMI Persistence

Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

François HubautCreated Thu Aug 19Updated Sun Dec 259e07f6e7-83aa-45c6-998e-0af26efd0a85windows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection_ioc:
        - ScriptBlockText|contains|all:
              - 'New-CimInstance '
              - '-Namespace root/subscription '
              - '-ClassName __EventFilter '
              - '-Property ' # is a variable name
        - ScriptBlockText|contains|all:
              - 'New-CimInstance '
              - '-Namespace root/subscription '
              - '-ClassName CommandLineEventConsumer '
              - '-Property ' # is a variable name
    condition: selection_ioc