WMI Persistence - Script Event Consumer File Write

Title: WMI Persistence - Script Event Consumer File Write
Status: test
Description:Detects file writes of WMI script event consumer
References:
  -https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Author: Thomas Patzke
Date: 2018-03-07
modified:2021-11-27
Tags:

• -'attack.privilege-escalation'
• -'attack.t1546.003'
• -'attack.persistence'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    Image: 'C:\WINDOWS\system32\wbem\scrcons.exe'
  condition:selection
Falsepositives:
  -Dell Power Manager (C:\Program Files\Dell\PowerManager\DpmPowerPlanSetup.exe)
Level: high