detection.wiki

Detection rules › Sigma

Suspicious Scripting in a WMI Consumer

Severity
high
Author
Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Source
upstream

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.005 Command and Scripting Interpreter: Visual Basic

Event coverage

ProviderEvent IDTitle
Sysmon19WmiEvent (WmiEventFilter activity detected)
Sysmon20WmiEvent (WmiEventConsumer activity detected)
Sysmon21WmiEvent (WmiEventConsumerToFilter activity detected)

Stages and Predicates

Stage 1: selection_destination

or:
Destination|contains: .downloadfile
Destination|contains: net.webclient
Destination|contains: new-object
Destination|contains: .downloadstring
Destination|contains: net.webclient
Destination|contains: new-object
Destination|contains: ' -decode '
Destination|contains: ' -enc '
Destination|contains: ' -nop '
Destination|contains: ' -noprofile '
Destination|contains: ' iex('
Destination|contains: 'System.Security.Cryptography.FromBase64Transform'
Destination|contains: WScript.Shell

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Destinationmatch
  • -decode
  • -enc
  • -nop
  • -noprofile
  • iex(
  • .downloadfile
  • .downloadstring
  • System.Security.Cryptography.FromBase64Transform
  • WScript.Shell
  • net.webclient
  • new-object

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.