administrators and software may use permanent wmi event subscriptions. review the consumer, filter query, and creator context; tune known authorized subscriptions with the detection filter macro.

splunk

Techniques

Sample rules

WMI Permanent Event Subscription

source: splunk
technicques:

Description

Detects permanent WMI event subscriptions that are containing CommandLineEventConsumer or ActiveScriptEventConsumer. Due to their command execution capabilties, given WMI consumers are often leveraged by adversaries for both execution and persistence purposes.

Detection logic

`wmi`
EventCode=5861

| spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause

| spath input=_raw output=consumer_xml path=Event.UserData.Operation_ESStoConsumerBinding.CONSUMER

| eval possible_cause=coalesce(possible_cause, Message)

| rex field=Message "(?i)Consumer\s*=\s*(?<consumer_message>[^;\r\n]+)"

| eval consumer=coalesce(consumer_xml, consumer_message)

| where isnull(consumer) OR consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\""

| rex field=possible_cause "(?ms)instance of __EventFilter\s+\{(?<event_filter>.*?)\};\s*Perm\. Consumer:"

| rex field=event_filter "(?m)^\s*Name\s*=\s*\"(?<filter_name>[^\"]*)\"\s*;"

| rex field=event_filter "(?m)^\s*Query\s*=\s*\"(?<filter_query>.*?)\"\s*;"

| rex field=event_filter "(?m)^\s*EventNamespace\s*=\s*\"(?<filter_event_namespace>[^\"]*)\"\s*;"

| rex field=event_filter "(?m)^\s*QueryLanguage\s*=\s*\"(?<filter_query_language>[^\"]*)\"\s*;"

| rex field=possible_cause "(?s)Perm\. Consumer:\s+instance of (?<consumer_type>[A-Za-z0-9_]+)\s+\{(?<consumer_properties>.*?)\};\s*\Z"

| rex field=consumer_properties "(?m)^\s*Name\s*=\s*\"(?<consumer_name>[^\"]*)\"\s*;"

| rex field=consumer_properties "(?m)^\s*CommandLineTemplate\s*=\s*\"(?<command_line_template>.*?)\"\s*;"

| rex field=consumer_properties "(?m)^\s*RunInteractively\s*=\s*(?<run_interactively>[^;]+)\s*;"

| rex field=consumer_properties "(?m)^\s*ScriptingEngine\s*=\s*\"(?<scripting_engine>[^\"]*)\"\s*;"

| rex field=consumer_properties "(?ms)^\s*ScriptText\s*=\s*\"(?<script_text>.*?)\"\s*;\s*$"

| where consumer_type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer")

| eval command=coalesce(command_line_template, script_text)

| fillnull value=NULL

| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(consumer) as consumer
              values(consumer_type) as consumer_type
              values(consumer_name) as consumer_name
              values(command_line_template) as command_line_template
              values(run_interactively) as run_interactively
              values(scripting_engine) as scripting_engine
              values(script_text) as script_text
              values(command) as command
  by Computer, filter_name, filter_query, filter_event_namespace, filter_query_language

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| rename Computer as dest

| `wmi_permanent_event_subscription_filter`