Detection rules › Sigma

WMI Persistence - Security

Severity
medium
Author
Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
Source
upstream

Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription
Privilege EscalationT1546.003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

Event coverage

ProviderEvent IDTitle
Security-Auditing4662An operation was performed on an object.

Stages and Predicates

Stage 1: selection

ObjectName|contains: subscription
ObjectType: 'WMI Namespace'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ObjectNamematch
  • subscription
ObjectTypeeq
  • WMI Namespace