LoFP / legitimate software creating script event consumers

Techniques

• t1546
• t1546.003

Sample rules

NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE

• source: sigma
• technicques:
  • t1546
  • t1546.003

Description

Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs.

Detection logic

condition: all of selection_*
selection_cli:
  CommandLine|contains|all:
  - ActiveScriptEventConsumer
  - ' CREATE '
selection_img:
- OriginalFileName: wmic.exe
- Image|endswith: \WMIC.exe