T1546.003 Windows Management Instrumentation Event Subscription
Sub-technique of T1546 Event Triggered Execution
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. Examples of events that may be subscribed to are the wall clock time, user login, or the computer's…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- WMI Backdoor Exchange Transport Agentcriticaltest · windows
- NewActiveScriptEventConsumer Creation Attempt via Wmic.EXEhightest · windows
- Suspicious Encoded Scripts in a WMI Consumerhightest · windows
- WMI Persistence - Command Line Event Consumerhightest · windows
- WMI Persistence - Script Event Consumer File Writehightest · windows
- Powershell WMI Persistencemediumtest · windows
- WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Loadmediumtest · windows
- WMI Event Subscriptionmediumtest · windows
- WMI Persistencemediumtest · windows
- WMI Persistence - Script Event Consumermediumtest · windows
- WMI Persistence - Securitymediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.