Detectionmediumtest

WMI Persistence - Script Event Consumer

Detects WMI script event consumers

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Thomas PatzkeCreated Wed Mar 07Updated Tue Oct 11ec1d5e28-8f3b-4188-a6f8-6e8df81dc28ewindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image: C:\WINDOWS\system32\wbem\scrcons.exe
        ParentImage: C:\Windows\System32\svchost.exe
    condition: selection

False Positives

Legitimate event consumers

Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button

References

Resolving title…

eideon.com

MITRE ATT&CK

Tactics

TA0003 · Persistence TA0004 · Privilege Escalation

Sub-techniques

T1546.003 · Windows Management Instrumentation Event Subscription

Rule Metadata

Rule ID

ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e

Status