Detectionhightest

New ActiveScriptEventConsumer Created Via Wmic.EXE

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Fri Jun 25Updated Tue Feb 14ebef4391-1a81-4761-a40a-1db446c0e625windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        CommandLine|contains|all:
            - 'ActiveScriptEventConsumer'
            - ' CREATE '
    condition: selection

False Positives

Legitimate software creating script event consumers

References

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0003 · Persistence

Sub-techniques

T1546.003 · Windows Management Instrumentation Event Subscription

Rule Metadata

Rule ID

ebef4391-1a81-4761-a40a-1db446c0e625

Status

test

Level

high

Type

Detection

Created

Fri Jun 25

Modified

Tue Feb 14

Author

Florian Roth (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.t1546.003

View on GitHub