WMI Persistence - Security

Title: WMI Persistence - Security
Status: test
Description:Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
References:
  -https://twitter.com/mattifestation/status/899646620148539397
  -https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
Date: 2017-08-22
modified:2022-11-29
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1546.003'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID: '4662'
    ObjectType: 'WMI Namespace'
    ObjectName|contains: 'subscription'
  condition:selection
Falsepositives:
  -Unknown (data set is too small; further testing needed)
Level: medium