COM and WMI Activation

COM Registry Records #

Rules select COM registration keys or shell DelegateExecute values in the Windows registry.

No rules currently have sufficient source evidence for selection in this section.

COM Registry Commands #

Rules select reg.exe commands containing InprocServer32.

No rules currently have sufficient source evidence for selection in this section.

COM Activation Context #

Rules select COM commands and incoming connections.

No rules currently have sufficient source evidence for selection in this section.

WMI Subscription Records #

Rules select WMI event filters, consumers, and bindings.

• Detect WMI Event Subscription Persistence Splunk

  The following analytic identifies the creation of WMI Event Subscriptions, which can be used to establish persistence or perform privilege escalation. It detects EventID 19 (EventFilter creation), EventID 20 (EventConsumer creation), and EventID 21 (FilterToConsumerBinding creation) from Sysmon logs. This activity is significant because WMI Event Subscriptions can execute code with elevated SYSTEM privileges, making it a powerful persistence mechanism. If confirmed malicious, an attacker could maintain long-term access, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.

WMI Namespace Access #

Security object audits select access to a WMI namespace. Access alone does not establish a subscription.

• WMI Persistence - Security Sigma

  Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

WMI Notification Queries #

Rules select WMI notification query and client fields. Event 5860 alone does not identify the consumer type.

No rules currently have sufficient source evidence for selection in this section.

WMI Commands and Methods #

Rules select subscription setup, process creation requests, and remote WMI commands.

No rules currently have sufficient source evidence for selection in this section.

WMI Processes and Modules #

Rules select WMI related process starts and module loads.

• Certutil payload obfuscation - Tchopper (command) Sigma

  Detects scenarios where an attacker attempts to abuse certutil command to download obfuscated malicious payload using the Tchopper tool.

• HackTool - Potential Impacket Lateral Movement Activity Sigma

  Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell Sigma

  Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

• Suspicious Autorun Registry Modified via WMI Sigma

  Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.

• Windows Shell/Scripting Processes Spawning Suspicious Programs Sigma

  Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

• WMI spwaning PowerShell process - WMImplant Sigma

  Detects scenarios where an attacker WMIimplant

WMI Correlated Activity #

Rules join WMI related events through an explicit relationship.

No rules currently have sufficient source evidence for selection in this section.

COM and WMI Context #

Rules can match several related Windows contexts, including COM or WMI activity.

No rules currently have sufficient source evidence for selection in this section.