Detection: WMI Permanent Event Subscription

 1`wmi`
 2EventCode=5861
 3
 4| spath input=_raw output=possible_cause path=Event.UserData.Operation_ESStoConsumerBinding.PossibleCause
 5
 6| spath input=_raw output=consumer_xml path=Event.UserData.Operation_ESStoConsumerBinding.CONSUMER
 7
 8| eval possible_cause=coalesce(possible_cause, Message)
 9
10| rex field=Message "(?i)Consumer\s*=\s*(?<consumer_message>[^;\r\n]+)"
11
12| eval consumer=coalesce(consumer_xml, consumer_message)
13
14| where isnull(consumer) OR consumer!="NTEventLogEventConsumer=\"SCM Event Log Consumer\""
15
16| rex field=possible_cause "(?ms)instance of __EventFilter\s+\{(?<event_filter>.*?)\};\s*Perm\. Consumer:"
17
18| rex field=event_filter "(?m)^\s*Name\s*=\s*\"(?<filter_name>[^\"]*)\"\s*;"
19
20| rex field=event_filter "(?m)^\s*Query\s*=\s*\"(?<filter_query>.*?)\"\s*;"
21
22| rex field=event_filter "(?m)^\s*EventNamespace\s*=\s*\"(?<filter_event_namespace>[^\"]*)\"\s*;"
23
24| rex field=event_filter "(?m)^\s*QueryLanguage\s*=\s*\"(?<filter_query_language>[^\"]*)\"\s*;"
25
26| rex field=possible_cause "(?s)Perm\. Consumer:\s+instance of (?<consumer_type>[A-Za-z0-9_]+)\s+\{(?<consumer_properties>.*?)\};\s*\Z"
27
28| rex field=consumer_properties "(?m)^\s*Name\s*=\s*\"(?<consumer_name>[^\"]*)\"\s*;"
29
30| rex field=consumer_properties "(?m)^\s*CommandLineTemplate\s*=\s*\"(?<command_line_template>.*?)\"\s*;"
31
32| rex field=consumer_properties "(?m)^\s*RunInteractively\s*=\s*(?<run_interactively>[^;]+)\s*;"
33
34| rex field=consumer_properties "(?m)^\s*ScriptingEngine\s*=\s*\"(?<scripting_engine>[^\"]*)\"\s*;"
35
36| rex field=consumer_properties "(?ms)^\s*ScriptText\s*=\s*\"(?<script_text>.*?)\"\s*;\s*$"
37
38| where consumer_type IN ("CommandLineEventConsumer", "ActiveScriptEventConsumer")
39
40| eval command=coalesce(command_line_template, script_text)
41
42| fillnull value=NULL
43
44| stats count min(_time) as firstTime
45              max(_time) as lastTime
46              values(consumer) as consumer
47              values(consumer_type) as consumer_type
48              values(consumer_name) as consumer_name
49              values(command_line_template) as command_line_template
50              values(run_interactively) as run_interactively
51              values(scripting_engine) as scripting_engine
52              values(script_text) as script_text
53              values(command) as command
54  by Computer, filter_name, filter_query, filter_event_namespace, filter_query_language
55
56| `security_content_ctime(firstTime)`
57
58| `security_content_ctime(lastTime)`
59
60| rename Computer as dest
61
62| `wmi_permanent_event_subscription_filter`