Title:WMI Persistence - Command Line Event Consumer Status:test Description:Detects WMI command line event consumers References: -https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ Author: Thomas Patzke Date: 2018-03-07 modified:2021-11-27 Tags:
-'attack.privilege-escalation'
-'attack.t1546.003'
-'attack.persistence'
Logsource:
category: image_load
product: windows
Detection: selection: Image:
'C:\Windows\System32\wbem\WmiPrvSE.exe' ImageLoaded|endswith:
'\wbemcons.dll' condition:selection Falsepositives:
-Unknown (data set is too small; further testing needed) Level:high
