Detection: WMI Permanent Event Subscription - Sysmon

Description

Detects the creation, modification or deletion of a WMI permanent event subscription using Sysmon EventID 21.

Search

 1`sysmon`
 2EventCode=21
 3Operation IN (
 4    Created,
 5    Deleted,
 6    Modified
 7)
 8
 9
10| stats count min(_time) as firstTime
11              max(_time) as lastTime
12    BY dest user Consumer Filter
13
14
15| `security_content_ctime(firstTime)`
16
17| `security_content_ctime(lastTime)`
18
19| `wmi_permanent_event_subscription___sysmon_filter`

Data Source

Name	Platform	Sourcetype	Source
Sysmon EventID 21	Windows	'XmlWinEventLog'	'XmlWinEventLog:Microsoft-Windows-Sysmon/Operational'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you must be collecting Sysmon data using Sysmon version 6.1 or greater and have Sysmon configured to generate alerts for WMI activity (eventID= 19, 20, 21). In addition, you must have at least version 6.0.4 of the Sysmon TA installed to properly parse the fields.

Known False Positives

Administrators and software may create authorized WMI subscriptions. Review the consumer and filter paths, then tune known authorized subscriptions with the detection filter macro.

Associated Analytic Story

• Suspicious WMI Use

Intermediate Findings

References

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L5

• https://in.security/2019/04/03/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/

• https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1546.003/T1546.003.md

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L44

• https://github.com/trustedsec/SysmonCommunityGuide/blob/master/chapters/WMI-events.md

• https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/

• https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1546.003/T1546.003.yaml#L86

Atomic Tests

Learn more about Atomic Red Team tests here.

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 13