Execution via WMI ActiveScript Event Consumer

[rule]
description = """
Identifies the creation or execution of a Windows script via a Windows Management Instrumentation Script consumer. The
ActiveScriptEventConsumer class runs a predefined script in an arbitrary scripting language when an event is delivered
to it. This is a legit feature but rarely used and can be a sign of execution or persistence via a malicious WMI Script
consumer.
"""
id = "396f3062-05ba-4594-b83e-9bd6597f0e5e"
license = "Elastic License v2"
name = "Execution via WMI ActiveScript Event Consumer"
os_list = ["windows"]
reference = [
    "https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html",
    "https://learn.microsoft.com/en-us/windows/win32/wmisdk/activescripteventconsumer",
]
version = "1.0.12"

query = '''
process where event.action == "start" and
 (
  process.parent.executable : "?:\\Windows\\Sys*\\wbem\\scrcons.exe" or
  descendant of [process where event.action == "start" and process.executable : "?:\\Windows\\Sys*\\wbem\\scrcons.exe"] or
  (process.pe.original_file_name : "wmic.exe" and process.command_line : "*create*" and process.command_line : "*ActiveScriptEventConsumer*")
  ) and
  not (process.executable : "?:\\Windows\\System32\\wscript.exe" and
       user.id : "S-1-5-18" and process.args : "?:\\Windows\\System32\\sleeper.vbs") and
  not process.executable :
              ("?:\\Program Files\\*.exe",
               "?:\\Program Files (x86)\\*.exe",
               "?:\\Windows\\System32\\gpupdate.exe",
               "?:\\Windows\\Microsoft.NET\\Framework64\\v*\\ngen.exe",
               "?:\\Windows\\Microsoft.NET\\Framework64\\v*\\ngentask.exe")  and
  not (process.executable : "?:\\Windows\\System32\\schtasks.exe" and
       process.args : "\"C:\\Program Files\\Adobe\\Adobe Creative Cloud Experience\\CCXProcess.exe\"") and
  not (process.executable : "?:\\Windows\\System32\\omadmprc.exe" and user.id : "S-1-5-18") and process.parent.executable != null and
  not (process.executable : "?:\\Windows\\system32\\conhost.exe" and process.args : "0xffffffff" and process.args : "-ForceV1") and
  not process.hash.sha256 :
                   ("4620eaed30bea5f44b2655df1592f2d3cfc45042f513876090c30153a3e23815",
                    "0e9a6b9d0481a0f9aa49e6f53bc87414ecb84a6d45ef301f6abfde07a8e894a4",
                    "0f635ffad292ec796dec18cafe896f09168ad2cdefec4fc8530a6a538db21e54",
                    "d13f5e3d679ffb5787eb0227741cf3e3e3b476a831742e086c1aebea15acf735",
                    "ac3e1f40ce7bb7e31f9f2804fdc495ac566c5c072d850c66525926ca18fa7a27",
                    "5c9382277658a46d9918c81b760b0e7caea3639266bcdda68413ac63f9ad6f68") and
  not process.parent.executable :
                     ("?:\\Program Files\\Adobe\\Adobe Creative Cloud Experience\\libs\\node.exe",
                      "?:\\Program Files (x86)\\Google\\GoogleUpdater\\*\\updater.exe")
'''

min_endpoint_version = "7.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1047"
name = "Windows Management Instrumentation"
reference = "https://attack.mitre.org/techniques/T1047/"

[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.005"
name = "Visual Basic"
reference = "https://attack.mitre.org/techniques/T1059/005/"

[[threat.technique.subtechnique]]
id = "T1059.007"
name = "JavaScript"
reference = "https://attack.mitre.org/techniques/T1059/007/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "7.16.0"