Suspicious Encoded Scripts in a WMI Consumer

Title: Suspicious Encoded Scripts in a WMI Consumer
Status: test
Description:Detects suspicious encoded payloads in WMI Event Consumers
References:
  -https://github.com/RiccardoAncarani/LiquidSnake
Author: Florian Roth (Nextron Systems)
Date: 2021-09-01
modified:2022-10-09
Tags:

• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.t1047'
• -'attack.persistence'
• -'attack.t1546.003'

Logsource:

• product: windows
• category: wmi_event

Detection:
  selection_destination:
    Destination|base64offset|contains:
      -'WriteProcessMemory'
      -'This program cannot be run in DOS mode'
      -'This program must be run under Win32'

  condition:selection_destination
Falsepositives:
  -Unknown
Level: high