Detection: WMI Permanent Event Subscription - Sysmon

Description

The following analytic identifies the creation of WMI permanent event subscriptions, which can be used to establish persistence or perform privilege escalation. It leverages Sysmon data, specifically EventCodes 19, 20, and 21, to detect the creation of WMI EventFilters, EventConsumers, and FilterToConsumerBindings. This activity is significant as it may indicate an attacker setting up mechanisms to execute code with elevated SYSTEM privileges when specific events occur. If confirmed malicious, this could allow the attacker to maintain persistence, escalate privileges, and execute arbitrary code, posing a severe threat to the environment.

Search

 1`sysmon` EventCode=21
 2  
 3| stats count min(_time) as firstTime max(_time) as lastTime
 4    BY dest dvc object
 5       object_attrs object_category object_path
 6       signature signature_id src
 7       status user user_id
 8       vendor_product Consumer ConsumerNoQuotes
 9       Filter FilterNoQuotes
10  
11| `security_content_ctime(firstTime)`
12  
13| `security_content_ctime(lastTime)`
14  
15| `wmi_permanent_event_subscription___sysmon_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 21	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.

Known False Positives

Although unlikely, administrators may use event subscriptions for legitimate purposes.

Associated Analytic Story

• Suspicious WMI Use

Finding

Intermediate Findings

References

• https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md

• https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/

• https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 12